information about () in the UPnP protocol, which allows the traffic to be directed to any recipient using the 'SUBSCRIBE' operation specified in the standard. The vulnerability has been assigned the code name . This vulnerability can be exploited to extract data from networks protected by Data Loss Prevention (DLP) systems, to perform port scanning on computers within the internal network, and to enhance DDoS attacks using millions of UPnP-connected devices such as cable modems, home routers, gaming consoles, IP cameras, TV boxes, media centers, and printers.
The Problem because the function 'SUBSCRIBE' specified in the specification allows any external attacker to send HTTP packets with a Callback header and use the UPnP device as a proxy to send requests to other hosts. The 'SUBSCRIBE' function is defined in the UPnP specification and is used to track changes in other devices and services. Using the Callback HTTP header, an arbitrary URL can be specified to which the device will attempt to connect.
The issue affects almost all UPnP implementations based on , released before April 17. Including the existence of the vulnerability in the open package with the implementation of a wireless access point (WPS AP). A fix is currently available in the form of . Updates have not yet been released in the distributions (, , , , , , ). The problem is also solutions based on the open UPnP stack , for which there is currently no information about fixes.
The UPnP protocol defines a mechanism for automatically discovering devices on a local network and interacting with them. The protocol was originally designed for use within internal local networks and does not provide any forms of authentication and verification. Despite this, millions of devices do not disable UPnP support on external network interfaces and for requests from the global network. An attack can be carried out through any such UPnP device.
For example, Xbox One consoles can be attacked through network port 2869, as they allow tracking of changes such as content sharing through the SUBSCRIBE command.
The Open Connectivity Foundation (OCF) was notified of the issue late last year, but initially refused to consider it as a vulnerability in the specification. Following a subsequent, more detailed report, the existence of the problem was acknowledged and a provision was added to the specification requiring the use of UPnP only on LAN interfaces. Since the problem arises from a shortcoming in the standard, fixing the vulnerability in individual devices may take considerable time, and firmware updates for older devices may not be released.
As a workaround for protection, it is recommended to isolate UPnP devices from external requests using a firewall, block external HTTP 'SUBSCRIBE' and 'NOTIFY' requests on intrusion prevention systems, or disable the UPnP protocol on external network interfaces. Manufacturers are advised to disable the SUBSCRIBE function in default settings and limit it to only accepting requests from the internal network upon activation.
To test your devices for susceptibility to the vulnerability a special toolkit written in Python and distributed under the MIT license.
Source: opennet.ru
