Netgear RAX30 Multiple Vulnerabilities

ReadyShare Implementation Symlink Attacks (CVE-2023-27850)

The default ReadyShare functionality automatically shares the contents of an inserted USB drive or other configured network share. These shares are accessible to a guest account via FTP by default or via HTTP unauthenticated. An attacker with the ability to configure a share or insert a USB drive with specially crafted symlinks can reveal and modify arbitrary files on the device.

• CVSSv3 - 7.6 - AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ReadyShare Default Share Configurations Allow Code Execution (CVE-2023-27851)

The lighttpd configuration for the device is configured to execute any php code in the “/webs” directory by default when browsed to. Since all file shares are served from “/webs/shares,” it is possible for user-provided code and scripts to be executed. For example, if an attacker places code, such as a php webshell, into a share and then visits it (for example: http://<device>/shares/USB_Storage/share/webshell.php), they are able to execute arbitrary code on the device.

• CVSSv3 - 7.6 - AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Buffer Overflow in Password Reset CGI, Traffic Management CGI, and rex_cgi (CVE-2023-27852)

During the parsing of requests containing json input to any of the primary CGIs, a buffer overflow can be triggered that could result in code execution. Due to other protections enabled on the device such as ASLR, however, this flaw must be combined with other flaws for an exploit to be reliably crafted.

The vulnerable CGIs are:

• rex_cgi

• reset_pwd.cgi

• tm_block.cgi

Please note that “rex_cgi” requires authentication in order to trigger the vulnerable code. The other two binaries can be triggered without authentication.

By providing valid json in request bodies with a content length greater than 4097, an overflow will occur leading to a segmentation fault and crashing the http service.

• CVSSv3 - 8.3 - AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Overflow to Format String Attack in SOAP Server (CVE-2023-27853)

The soap_serverd service listening on ports 5000 and 5043 on the LAN side of the device contains vulnerable uses of “strcat()”, that when exploited, can be used to execute a format string attack, which may result in arbitrary code execution. Due to other protections enabled on the device such as ASLR, however, this flaw must be combined with other flaws for an exploit to be reliably crafted.

When sending requests to the SOAP service, a specially crafted SOAPAction may be able to cause a buffer overflow and cause an ensuing sprintf() call to use a potentially malicious format string. Specifically, sending more than 853 bytes as the message after the # character in the SOAPAction header will result in a crash of some sort ( Where a crash occurs is dependent on the length of the payload and hence the size of the overflow). More specifically, sending a message of 1819+ bytes will start overwriting the variables passed to the sprintf() call at the end of the following snippet from a decompilation of soap_serverd:

The local_58 and local_54 variables in this sprintf() get overwritten, allowing an attacker to create an opportunity for a format string attack which can circumvent the stack canaries in place in the soap_serverd binary (though notably only if the attacker knows base addresses, which due to ASLR being enforced, is difficult without an info leak bug).

When examining the service with a debugger, the following request will demonstrate the overflow before causing a crash due to stack smashing detected in soap_serverd:

• CVSSv3 - AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - 8.3

CSRF Bypass (CVE-2023-1205)

The cross-site request forgery protection implemented in the web interface for the device is trivially bypassable. By browsing to any page on the device that is available unauthenticated, the CSRF token generated may be copied and reused in any new arbitrary request. For example, by first browsing to “/pwd_reset/pwd_reset_checkSN.html,” which is available unauthenticated, the CSRF token from the response will cause whatever request is sent next to be considered valid, regardless of where that request is destined for on the device.

• CVSSv3 - 8.0 - AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H