information about () in the UPnP protocol, allowing traffic to be sent to arbitrary recipients using the ‘SUBSCRIBE’ operation provided by the standard. The vulnerability has been assigned the codename . This vulnerability can be exploited to extract data from networks protected by Data Loss Prevention (DLP) systems, facilitate port scanning of internal network computers, and amplify DDoS attacks using millions of UPnP devices connected to the global network, such as cable modems, home routers, game consoles, IP cameras, TV set-top boxes, media centers, and printers.
Problemet The issue is that the specified function ‘SUBSCRIBE’ in the specification allows any external attacker to send HTTP packets with a Callback header and use the UPnP device as a proxy to send requests to other hosts. The ‘SUBSCRIBE’ function is defined in the UPnP specification and is used to monitor changes in other devices and services. With the HTTP Callback header, an arbitrary URL can be specified, to which the device attempts to connect.
The problem affects almost all UPnP implementations based on , released before April 17. Vulnerability in an open package with a wireless access point (WPS AP) implementation. A fix is currently available in the form of . Updates have not yet been released in distributions (, , , , , , ). The issue also solutions based on the open UPnP stack , for which no information about fixes is currently available.
The UPnP protocol defines a mechanism for automatic discovery of devices in the local network and interaction with them. The protocol was originally designed for use in internal local networks and does not provide for any forms of authentication or verification. Despite this, millions of devices do not disable UPnP support on external network interfaces and for requests from the global network. An attack can be carried out through any such UPnP device.
For example, Xbox One consoles can be attacked through network port 2869, as they allow monitoring changes, such as sharing content, using the SUBSCRIBE command.
Open Connectivity Foundation (OCF) blev informeret om problemet i slutningen af sidste år, men afslog i starten at betragte det som en sårbarhed i specifikationen. Efter en mere detaljeret rapport blev problemet anerkendt, og der blev tilføjet et krav i specifikationen om at anvende UPnP kun på LAN-grænseflader. Da problemet er forårsaget af mangler i standarden, kan det tage lang tid at rette sårbarheden i enkelte enheder, og for ældre enheder kan firmwareopdateringer muligvis ikke blive tilgængelige.
Som midlertidige beskyttelsesmetoder anbefales det at isolere UPnP-enheder fra eksterne forespørgsler ved hjælp af en firewall, blokere eksterne HTTP-forespørgsler som "SUBSCRIBE" og "NOTIFY" på indtrængningsbeskyttelsessystemer, eller deaktivere UPnP-protokollen på de eksterne netværksgrænseflader. Producenterne anbefales at deaktivere SUBSCRIBE-funktionen som standardindstilling og begrænse aktiveringen til kun at modtage forespørgsler fra det interne netværk.
Til test af sårbarhed af deres enheder et særligt værktøj, skrevet i Python og distribueret under MIT-licensen.
Kilde: opennet.ru
