ProCheckUp Security Advisory 2007.40

`PR07-40: Authentication Bypass, Passwords Leakage and SNMP Injection on  
3Com AP 8760  
  
Vulnerability Found: 6th November 2007  
  
Vendor Informed: 2nd May 2008  
  
Date Public: 14th November 2008  
  
Severity: Medium  
  
Credits: Adrian Pastor of ProCheckUp Ltd (www.procheckup.com).  
  
Vulnerability #1:  
  
Description:  
  
The HTTP authentication mechanism of the 3Com AP 8760 works as follows:  
  
1. Router checks if credentials submitted by user are valid  
  
2. If valid, the router's web interface redirects the user to URLs that  
should only be available to authenticated admin users  
  
What's important to note is that every time an "authenticated" URL is  
accessed, there is _no_ authentication data being sent within HTTP  
requests whatsoever. There are no passwords, or session IDs being  
submitted at all within HTTP requests. Instead, the AP uses the  
administrator's source IP address as authentication data.  
  
This means that the authentication state relies on the false assumption  
that post-authentication URLs won't be known by an attacker and that the  
attacker and the administrator will _not_ share the same source IP  
address. By simply accessing administrative URLs in a browser from _the  
same IP address_ (i.e.: by sharing the same proxy or NATed IP address),  
the authentication check can be bypassed completely.  
  
Notes:  
  
Although URL paths are different, these issues appear to be similar to  
those found on other 3com router models:  
  
http://www.securityfocus.com/bid/11408/discuss  
http://seclists.org/vulnwatch/2005/q1/0042.html  
  
  
Proof of concept:  
  
The following is an example of an administrative page that would allow  
an attacker to change settings:  
  
http://<target_IP>/advanced.htm  
  
  
Vulnerability #2:  
  
Description:  
  
Additionally, sensitive data such as the admin password is returned  
within certain pages. Although after bypassing the authentication the  
attacker wouldn't need to know the admin password anyway, this could be  
handy for a cracker in scenarios such as the following:  
  
1. The authentication bypass is fixed by updating the firmware to a  
patched version (attacker would still be able to access the device since  
he/she knows the admin password)  
  
2. The attacker could try the same password on other servers owned by  
the same target company since it's a common human weakness to reuse  
passwords.  
  
Proof of concept:  
  
The following URLs return the admin password within 'hidden' form fields:  
  
http://<target_IP>/s_brief.htm  
http://<target_IP>/s.htm  
  
  
Vulnerability #3:  
  
Description:  
  
It's possible to launch SNMP injection attacks. By changing the system  
name via SNMP, it's possible to inject a persistent XSS payload on  
several pages including the _login page_. Thus, the attacker has an  
opportunity to redirect the admin password to his own site by  
overwriting the login form's action attribute.  
  
The payload gets returned within the login page's 'title' tag. i.e.:  
  
<title>3Com Wireless 8760 Dual Radio 11a/b/g Access Point  
PAYLOAD_GOES_HERE</title>  
  
Example of snmpset command that changes the AP's system name:  
  
snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE"  
  
  
Successfully tested on:  
  
3COM: AP8760: Dual Radio 11a/b/g Access Point, Software v2.1.13b05_sh,  
Bootrom v1.2.1, Hardware R02  
  
Note: model and firmware info extracted via SNMP from  
'SNMPv2-MIB::sysDescr.0' OID.  
  
Consequences:  
  
Administrative access can be gained to the device without knowledge of  
the admin password. The caveat is that the attacker must share the same  
source IP address with the administrator. Therefore, this vulnerability  
would mostly be exploited by internal users only. Sensitive information  
such as administrative credentials can be obtained.  
  
Admin passwords can be compromised given that an attacker has first  
gained SNMP write access.  
  
  
Workaround:  
  
No workaround is available for the authentication bypass and passwords  
leakage issue. SNMP injection can be resolved by disabling SNMP write  
access.  
  
  
References:  
  
http://www.procheckup.com/  
http://www.3com.com/products/en_US/detail.jsp?pathtype=purchase&tab=features&sku=3CRWE876075  
  
  
Legal:  
  
Copyright 2008 Procheckup Ltd. All rights reserved.  
  
Permission is granted for copying and circulating this Bulletin to the  
Internet community for the purpose of alerting them to problems, if and  
only if, the Bulletin is not edited or changed in any way, is  
attributed to Procheckup, and provided such reproduction and/or  
distribution is performed for non-commercial purposes.  
  
Any other use of this information is prohibited. Procheckup is not  
liable for any misuse of this information by any third party.  
`