Sierra Wireless AirLink Raven XE Industrial 3G Gateway CSRF / File Upload
Posted on 28 June 2016
*Sierra Wireless AirLink Raven XE Industrial 3G Gateway - Multiple Vulnerabilities* *About* http://www.sierrawireless.com/products-and-solutions/gateway-solutions/raven-series/ Rugged Design and Advanced Security for Fixed and Portable Wireless Communication Raven XE/XT Compact design for industrial applications Ethernet (XE) or serial (XT) options with USB and digital I/O *APPLICATIONS:* Remote Monitoring Surveillance Vending/Kiosk Banking/ATM Digital Signage *1. Weak Credential Management * The device web administration interface (TCP port 9191) and Airlink AT Command Interpreter (Telnet TCP 2332) uses non-random default credentials of user:12345. The application / system does not enforce a forced password change for default credentials. A network-based attacker can use these credentials to gain privileged access to these management interfaces. *Affected devices: * A Device Models Raven XE HSPA Radio Module TypeMC8790 Radio Firmware VersionK2_0_7_35AP C:/WS/FW/K2_0_7_35AP/MSM6290/SRC 2010/03/04 17:37:08 ATDevice ID0x010112DE143DD5A2 ATALEOS Software Version H2225E_4.0.10.001 Jul 21 2011 Device Hardware Configuration 0c150100000300000000000000000000 Boot Version 3.7.2 B Device Models GX400 Radio Module Type MC5728 Radio Firmware Versionp2815600,53239 [Aug 27 2012 10:01:25] ATGlobal IDCA1303309191005 ATALEOS Software Version 4.3.4 ALEOS Build number 009 Device Hardware Configuration 12160306000700000000000000000000 Boot Version 1.0.11 MSCI Version 10 C Device Models GX440 + potentially all GX models *Comment from the vendor*: Sierra Wireless strongly recommends that customers change all the default passwords on equipment they purchase, especially for interfaces that are enabled on public networks. We also recommend that customers use the firewall configuration options to disable these interfaces on the cellular WAN interface as an extra precaution. +++++ *Additional Issue / Note * It should be pointed out that during investigation of these issues, it was found that at least one Raven device accessible over the internet had been configured to forward port 80 traffic to the unauthenticated web configuration form for an Anybus S Ethernet Controller connected to the LAN side of the gateway. This is not a product vulnerability per se because the forwarding feature is not enabled by default and has legitimate application when the gateway is operating on private networks and/or the receiving device has proper security measures in place. Sierra Wireless strongly recommends that port forwarding never be enabled to unauthenticated or otherwise insecure interfaces on the LAN side of the gateway and especially not when the gateway is operating on public networks. +++++ *2. Ace Manager contains a global CSRF vulnerability * There is no anti-CSRF token in use. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. *Affected devices: * All Raven XE/XT models *Comment from the vendor*: Sierra Wireless acknowledges the lack of anti-CSRF tokens in the Ace Manager interface and will consider adding them in a future release. In the meantime we recommend customers follow best practice for sensitive networks and not simultaneously connect to critical infrastructure equipment and the public internet where CSRF attacks are likely to be found. Note that the Raven XE/XT devices are past end of life and will not receive firmware updates to address this issue so adherence to best practice is strongly recommended. +++++ *3. Sensitive information leakage via GET requests * Application uses GET requests post login and for certain functions. The following GET request happens during login: GET /admin/AceManager.htm?hwstr= abcdef00000g00000000000000000000&user=<value_mapped_to_user>&pwd=<value_mapped_to_password> HTTP/1.1 Host: IP:9191 User-Agent: blah Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://IP:9191/index.htm Authorization: Basic dXNlcjoxMjM0NQ== Connection: keep-alive These GET requests with obfuscated creds are therefore prone to sniffing, and can be used to log in directly to AceManager. You will be logged in to device management portal by calling the following url: http://IP/admin/AceManager.htm?hwstr=abcdef00000g00000000000000000000&user= <value_mapped_to_user>&pwd=<value_mapped_to_password> *Points to note: * 1. These creds appear to be mapped to HTTP login (user:12345). A change in http login changes these creds. 2. GET requests - vulnerable to sniffing. 3. Possibility of automating password brute force attacks *Affected devices: * All Raven XE/XT models *Comment from the vendor*: Sierra Wireless acknowledges this issue in versions of ALEOS compatible with the end of life Raven XE/XT family. It does not exist in current ALEOS products. As previously noted there will be no firmware updates to address this issue on the Raven XE/XT. Sierra Wireless strongly recommends that best practices be followed and the Ace Manager interface be disabled on the cellular WAN connection, particularly when the device is active on public networks in order to prevent exploitation of this sensitive information by internet-based attackers. +++++ *4. Unauthenticated access to directories + Arbitrary File Upload * Following directories can be accessed without any authentication: http://IP/admin/AceManager.htm?hwstr= http://IP:9191/admin/UpLoadTemp.htm http://IP:9191/admin/UpLoad.htm With access to ACEManager GUI */admin/UpLoadTemp.htm*, everyone gets access to following options: -> Upload, Download, Refresh options, Reboot option is also offered now. There is also Logout option on this screen pointing that we are logged in. No other function is shown. Anyone can potentially be able to reboot the box. No authentication is needed. Moving ahead. When we make a request to http://IP:9191/admin/AceManager.htm, there are 3 GET requests made by the application: http://IP:9191/admin/AceManager.htm http://IP:9191/admin/UpLoadTemp.htm http://IP:9191/admin/AceManager.htm When we look at http://IP:9191/admin/UpLoadTemp.htm, there is no authentication on this page, and we find it offers an option to upload a template file, with three options - a. Load to screen b. Preview c. Load & Apply It may be possible to load a template that when loaded, modifies the configuration and makes the device unavailable for access & usability. Looking at the page source of /admin/UpLoadTemp.html, we find that templates are uploaded to /Upload. When we access http://IP:9191/admin/UpLoad.htm, there is no auth (again) on this page, and it gives few more options and information. a. Any unauthenticated user can upload any file to the device b. Arbitrary files can be uploaded via the upload form. Files get uploaded to / c. Uploaded files can be accessed at: http://IP/<file_name> *Affected devices: * All Raven XE/XT models *Comment from the vendor*: Sierra Wireless acknowledges in versions of ALEOS compatible with the end of life Raven XE/XT family. It does not exist in current ALEOS products. As previously noted there will be no firmware updates to address this issue on the Raven XE/XT. Sierra Wireless strongly recommends that the AceManager interface be disabled on the cellular WAN connection, particularly when the device is active on public networks in order to prevent exploitation of this sensitive information by internet-based attackers. +++++ -- Best Regards, Karn Ganeshen
