What the Ridiculous Fuck, D-Link?!

As mentioned in an update to my post on the HNAP bug in the DIR-890L, the same bug was reported earlier this year in the DIR-645, and a patch was released. D-Link has now released a patch for the DIR-890L as well.

The patches for both the DIR-645 and DIR-890L are identical, so I’ll only examine the DIR-890L here.

Although I focused on command injection in my previous post, this patch addresses multiple security bugs, all of which stem from the use of strstr to validate the HNAP SOAPAction header:

1. Use of unauthenticated user data in a call to system (command injection)
2. Use of unauthenticated user data in a call to sprintf (stack overflow)
3. Unauthenticated users can execute privileged HNAP actions (such as changing the admin password)

Remember, D-Link has acknowledged all of the above in their security advisories, and thus were clearly aware of all these attack vectors.

So, did they remove the sprintf stack overflow?

sprintf(cmd_buf, “sh %s%s.sh > /dev/console”, “/var/run”, SOAPAction);

Nope.

Did they remove the call to system?

system(cmd_buf);

Of course not!

Are they using strcmp instead of strstr to validate the SOAPAction header?

if(strstr(SOAPAction, “http://purenetworks.com/HNAP1/GetDeviceSettings”) != NULL)

Pfft, why bother?

Their fix to all these fundamental problems is to use the access function to verify that the SOAPAction is a valid, expected action by ensuring that the file /etc/templates/hnap/<SOAPAction>.php exists:

A call to sprintf(), followed by a call to access()

OK, that does at least prevent users from supplying arbitrary data to sprintf and system.

However, they’ve added another sprintf to the code before the call to access; their patch to prevent an unauthenticated sprintf stack overflow includes a new unauthenticated sprintf stack overflow.

But here’s the kicker: this patch does nothing to prevent unauthenticated users from executing completely valid administrative HNAP actions, because all it does is ensure that the HNAP action is valid. That’s right, their patch doesn’t even address all the bugs listed in their own security advisory!

But I guess nobody really cares that any unauthenticated user can query information about hosts on the internal network, view/change system settings, or reset the router to its factory defaults:

$ wget --header="SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/SetFactoryDefault" http://192.168.0.1/HNAP1

You stay classy, D-Link.

Print Share Comment Cite Upload Translate

APA

() » What the Ridiculous Fuck, D-Link?!. Retrieved from https://www.truth.cx/2015/04/14/what-the-ridiculous-fuck-d-link/.

MLA

" » What the Ridiculous Fuck, D-Link?!." - , https://www.truth.cx/2015/04/14/what-the-ridiculous-fuck-d-link/

HARVARD

» What the Ridiculous Fuck, D-Link?!., viewed ,

VANCOUVER

- » What the Ridiculous Fuck, D-Link?!. [Internet]. [Accessed ]. Available from: https://www.truth.cx/2015/04/14/what-the-ridiculous-fuck-d-link/

CHICAGO

" » What the Ridiculous Fuck, D-Link?!." - Accessed . https://www.truth.cx/2015/04/14/what-the-ridiculous-fuck-d-link/

IEEE

" » What the Ridiculous Fuck, D-Link?!." [Online]. Available: https://www.truth.cx/2015/04/14/what-the-ridiculous-fuck-d-link/. [Accessed: ]

Select a language: Afrikaans Albanian Arabic Armenian Basque Bengali Bulgarian Catalan Cambodian Chinese (Mandarin) Croatian Czech Danish Dutch English Estonian Fiji Finnish French Georgian German Greek Gujarati Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Javanese Korean Latin Latvian Lithuanian Macedonian Malay Malayalam Maltese Maori Marathi Mongolian Nepali Norwegian Persian Polish Portuguese Punjabi Quechua Romanian Russian Samoan Serbian Slovak Slovenian Spanish Swahili Swedish Tamil Tatar Telugu Thai Tibetan Tonga Turkish Ukrainian Urdu Uzbek Vietnamese Welsh Xhosa <p>As mentioned in an update to my post on the <a href="http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/">HNAP bug</a> in the DIR-890L, the same bug was reported earlier this year in the DIR-645, and a <a href="ftp://ftp2.dlink.com/PRODUCTS/DIR-645/REVA/DIR-645_REVA_FIRMWARE_1.04.B13_BETA.ZIP">patch</a> was released. D-Link has now released a <a href="ftp://ftp2.dlink.com/PRODUCTS/DIR-890L/REVA/DIR-890L_REVA_FIRMWARE_PATCH_1.06.B01.ZIP">patch</a> for the DIR-890L as well. </p> <p>The patches for both the DIR-645 and DIR-890L are identical, so I’ll only examine the DIR-890L here. </p> <p>Although I focused on command injection in my <a href="http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/">previous post</a>, this patch addresses multiple security bugs, all of which stem from the use of <inline-code>strstr</inline-code> to validate the HNAP <inline-code>SOAPAction</inline-code> header:</p> <ol> <li>Use of unauthenticated user data in a call to <inline-code>system</inline-code> (command injection)</li> <li>Use of unauthenticated user data in a call to <inline-code>sprintf</inline-code> (stack overflow)</li> <li>Unauthenticated users can execute privileged HNAP actions (such as changing the admin password)</li> </ol> <p>Remember, D-Link has acknowledged all of the above in their <a href="http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10054">security</a> <a href="http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051">advisories</a>, and thus were clearly aware of all these attack vectors.</p> <p><span id="more-2413"></span></p> <p>So, did they remove the <inline-code>sprintf</inline-code> stack overflow?</p> <div id="attachment_2504" style="width: 810px" class="wp-caption aligncenter"><a href="http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack.png"><img src="http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack-1024x197.png" alt="sprintf(cmd_buf, "sh %s%s.sh > /dev/console", "/var/run", SOAPAction);" width="800" height="154" class="size-large wp-image-2504" srcset="http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack-1024x197.png 1024w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack-300x58.png 300w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack-250x48.png 250w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack-150x29.png 150w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_stack.png 1561w" sizes="(max-width: 800px) 100vw, 800px" /></a><p class="wp-caption-text">sprintf(cmd_buf, “sh %s%s.sh > /dev/console”, “/var/run”, SOAPAction);</p></div> <p>Nope.</p> <p>Did they remove the call to <inline-code>system</inline-code>?</p> <div id="attachment_2505" style="width: 310px" class="wp-caption aligncenter"><a href="http://www.devttys0.com/wp-content/uploads/2015/04/system_call.png"><img src="http://www.devttys0.com/wp-content/uploads/2015/04/system_call-300x147.png" alt="system(cmd_buf);" width="300" height="147" class="size-medium wp-image-2505" srcset="http://www.devttys0.com/wp-content/uploads/2015/04/system_call-300x147.png 300w, http://www.devttys0.com/wp-content/uploads/2015/04/system_call-250x123.png 250w, http://www.devttys0.com/wp-content/uploads/2015/04/system_call-150x74.png 150w, http://www.devttys0.com/wp-content/uploads/2015/04/system_call.png 716w" sizes="(max-width: 300px) 100vw, 300px" /></a><p class="wp-caption-text">system(cmd_buf);</p></div> <p>Of course not!</p> <p>Are they using <inline-code>strcmp</inline-code> instead of <inline-code>strstr</inline-code> to validate the <inline-code>SOAPAction</inline-code> header?</p> <div id="attachment_2506" style="width: 810px" class="wp-caption aligncenter"><a href="http://www.devttys0.com/wp-content/uploads/2015/04/strstr_still_there.png"><img src="http://www.devttys0.com/wp-content/uploads/2015/04/strstr_still_there-1024x152.png" alt="if(strstr(SOAPAction, "http://purenetworks.com/HNAP1/GetDeviceSettings") != NULL)" width="800" height="119" class="size-large wp-image-2506" srcset="http://www.devttys0.com/wp-content/uploads/2015/04/strstr_still_there-1024x152.png 1024w, http://www.devttys0.com/wp-content/uploads/2015/04/strstr_still_there-300x45.png 300w, http://www.devttys0.com/wp-content/uploads/2015/04/strstr_still_there-250x37.png 250w, http://www.devttys0.com/wp-content/uploads/2015/04/strstr_still_there-150x22.png 150w" sizes="(max-width: 800px) 100vw, 800px" /></a><p class="wp-caption-text">if(strstr(SOAPAction, “http://purenetworks.com/HNAP1/GetDeviceSettings”) != NULL)</p></div> <p>Pfft, why bother?</p> <p>Their fix to all these fundamental problems is to use the <inline-code>access</inline-code> function to verify that the <inline-code>SOAPAction</inline-code> is a valid, expected action by ensuring that the file <inline-code>/etc/templates/hnap/<SOAPAction>.php</inline-code> exists:</p> <div id="attachment_2507" style="width: 810px" class="wp-caption aligncenter"><a href="http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access.png"><img src="http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access-1024x357.png" alt="A call to sprintf(), followed by a call to access()" width="800" height="279" class="size-large wp-image-2507" srcset="http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access-1024x357.png 1024w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access-300x105.png 300w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access-250x87.png 250w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access-150x52.png 150w, http://www.devttys0.com/wp-content/uploads/2015/04/sprintf_access.png 1502w" sizes="(max-width: 800px) 100vw, 800px" /></a><p class="wp-caption-text">A call to sprintf(), followed by a call to access()</p></div> <p>OK, that does at least prevent users from supplying arbitrary data to <inline-code>sprintf</inline-code> and <inline-code>system</inline-code>. </p> <p>However, they’ve added another <inline-code>sprintf</inline-code> to the code <em>before</em> the call to <inline-code>access</inline-code>; <strong>their patch to prevent an unauthenticated <inline-code>sprintf</inline-code> stack overflow includes a new unauthenticated <inline-code>sprintf</inline-code> stack overflow</strong>.</p> <p>But here’s the kicker: <em>this patch does nothing to prevent unauthenticated users from executing completely valid administrative HNAP actions</em>, because all it does is ensure that the HNAP action is valid. That’s right, their patch doesn’t even address all the bugs listed in their own security advisory!</p> <p>But I guess nobody really cares that any unauthenticated user can query information about hosts on the internal network, view/change system settings, or reset the router to its factory defaults:</p> <pre class="brush: bash; title: ; notranslate"> $ wget --header="SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/SetFactoryDefault" http://192.168.0.1/HNAP1 </pre> <p><a href="https://www.youtube.com/watch?v=_HNJ93HCxUA&t=0m7s">You stay classy, D-Link</a>.</p> First name:

Last name: