Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Netgear RAX30 Multiple Vulnerabilities

High

Synopsis

ReadyShare Implementation Symlink Attacks (CVE-2023-27850)

The default ReadyShare functionality automatically shares the contents of an inserted USB drive or other configured network share. These shares are accessible to a guest account via FTP by default or via HTTP unauthenticated. An attacker with the ability to configure a share or insert a USB drive with specially crafted symlinks can reveal and modify arbitrary files on the device.

  • CVSSv3 - 7.6 - AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ReadyShare Default Share Configurations Allow Code Execution (CVE-2023-27851)

The lighttpd configuration for the device is configured to execute any php code in the “/webs” directory by default when browsed to. Since all file shares are served from “/webs/shares,” it is possible for user-provided code and scripts to be executed. For example, if an attacker places code, such as a php webshell, into a share and then visits it (for example: http://<device>/shares/USB_Storage/share/webshell.php), they are able to execute arbitrary code on the device.

  • CVSSv3 - 7.6 - AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Buffer Overflow in Password Reset CGI, Traffic Management CGI, and rex_cgi (CVE-2023-27852)

During the parsing of requests containing json input to any of the primary CGIs, a buffer overflow can be triggered that could result in code execution. Due to other protections enabled on the device such as ASLR, however, this flaw must be combined with other flaws for an exploit to be reliably crafted.

The vulnerable CGIs are:

  • rex_cgi

  • reset_pwd.cgi

  • tm_block.cgi

Please note that “rex_cgi” requires authentication in order to trigger the vulnerable code. The other two binaries can be triggered without authentication.

By providing valid json in request bodies with a content length greater than 4097, an overflow will occur leading to a segmentation fault and crashing the http service.

  • CVSSv3 - 8.3 - AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Overflow to Format String Attack in SOAP Server (CVE-2023-27853)

The soap_serverd service listening on ports 5000 and 5043 on the LAN side of the device contains vulnerable uses of “strcat()”, that when exploited, can be used to execute a format string attack, which may result in arbitrary code execution. Due to other protections enabled on the device such as ASLR, however, this flaw must be combined with other flaws for an exploit to be reliably crafted.

When sending requests to the SOAP service, a specially crafted SOAPAction may be able to cause a buffer overflow and cause an ensuing sprintf() call to use a potentially malicious format string. Specifically, sending more than 853 bytes as the message after the # character in the SOAPAction header will result in a crash of some sort ( Where a crash occurs is dependent on the length of the payload and hence the size of the overflow). More specifically, sending a message of 1819+ bytes will start overwriting the variables passed to the sprintf() call at the end of the following snippet from a decompilation of soap_serverd:

The local_58 and local_54 variables in this sprintf() get overwritten, allowing an attacker to create an opportunity for a format string attack which can circumvent the stack canaries in place in the soap_serverd binary (though notably only if the attacker knows base addresses, which due to ASLR being enforced, is difficult without an info leak bug).

When examining the service with a debugger, the following request will demonstrate the overflow before causing a crash due to stack smashing detected in soap_serverd:

  • CVSSv3 - AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - 8.3

CSRF Bypass (CVE-2023-1205)

The cross-site request forgery protection implemented in the web interface for the device is trivially bypassable. By browsing to any page on the device that is available unauthenticated, the CSRF token generated may be copied and reused in any new arbitrary request. For example, by first browsing to “/pwd_reset/pwd_reset_checkSN.html,” which is available unauthenticated, the CSRF token from the response will cause whatever request is sent next to be considered valid, regardless of where that request is destined for on the device.

  • CVSSv3 - 8.0 - AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Solution

See vendor supplied release notes for patching information: https://kb.netgear.com/000065553/RAX30-Firmware-Version-1-0-10-94

Disclosure Timeline

December 12, 2022 - Tenable discloses issues to vendor.
December 16, 2022 - Vendor requests clarification and acknowledges.
December 16, 2022 - Tenable provides clarification.
December 27, 2022 - Vendor requests clarification.
December 28, 2022 - Tenable acknowledges request and states that information will be provided as soon as possible.
January 5, 2023 - Vendor requests clarification.
January 6, 2023 - Tenable provides clarification.
January 9, 2023 - Vendor expressed technical issues on receiving images from prior email. Tenable resends in different format.
February 3, 2023 - Vendor requests extension to May 2023 for one of the reported issues.
February 6, 2023 - Tenable denies extension request.
February 7, 2023 - Vendor requests extension request to May 2023 for one of the reported issues.
February 7, 2023 - Tenable again denies extension request.
March 6, 2023 - Tenable notices security-related patch released without notice. Requests more information from vendor.
March 6, 2023 - Tenable notifies vendor that patches have been released without proper coordination. Our advisory will go out on March 8 unless otherwise disputed.
March 8, 2023 - Vendor requests disclosure extension despite patches being available. Tenable declines and cites originally communicated policy and timeline.

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

Tenable Advisory ID: TRA-2023-9
Credit:
Evan Grant, Jimi Sebree
Affected Products:
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94
Risk Factor:
High

Advisory Timeline

March 8, 2023 - Initial release.