Arendatud OpenWrt projekti ASU (Attended SysUpgrade) tööriistades on tuvastatud kriitilised haavatavused (CVE-2024-54143), mis vĂ”imaldavad kompromiteerida ehitusartefakte, mida levitatakse lĂ€bi teenuse sysupgrade.openwrt.org vĂ”i kolmandate osapoolte ASU-serverite, ning saavutada rĂŒndaja modifitseeritud firmware piltide installimine kasutajate sĂŒsteemides, kes kasutavad firmwarede uuendamiseks web-liidese selector.openwrt.org vĂ”i kĂ€skluste tööriista attended.sysupgrade.
RĂŒndajale piisab edukaks rĂŒnnakuks, kui saata ehitusettepaneku pĂ€ring ASU serverisse (sarnaseid pĂ€ringuid vĂ”ib saata iga kasutaja, ilma autentimiseta). Manipuleerides spetsiaalselt koostatud pakettide nimekirjaga, vĂ”ib rĂŒndaja korraldada eelnevalt genereeritud pahatahtlike piltide saatmise vastusena teiste kasutajate legitiimsetele ehitusettepanekutele.
ASU teenust kasutatakse OpenWrt-s firmware uuenduste loomiseks ja installimiseks ilma olemasolevate seadistuste ja kasutaja installitud pakettide kaotamiseta. Kasutaja saadab veebiliidese vĂ”i kĂ€surea tööriista kaudu pĂ€ringu uuendatud firmware pildi loomiseks, mĂ€rkides oma sĂŒsteemis installitud paketid. MĂ”ne aja pĂ€rast genereerib ASU server pildi, mis vastab tellitud sisule, pĂ€rast mida kasutaja laadib selle alla ja flashing oma seadmesse. TĂ€iendavalt on saadaval valik, mis vĂ”imaldab sĂ€ilitada olemasolevad seadistused uuendatud firmware-s.
Kasutajate pĂ€ringute töötlemise eest vastutab ASU Server, mis kĂ€ivitab automaatse firmware piltide koostamise ImageBuilder tööriista abil ning toetab ka varem ettevalmistatud ehituste vahemĂ€lu. Kui kasutaja on kĂŒsinud pilti, mis on juba varem koostatud ja serveris on endiselt kehtiv, siis annab sĂŒsteem kohe vahemĂ€lus oleva pildi ilma ehitusprotsessi kĂ€ivitamiseta.
RĂŒnnaku kĂ€itumine muutus vĂ”imalikuks tĂ€nu kahele haavatavusele:
- Haavatavus build_reques.py request processor in the Imagebuilder toolkit allows the insertion of custom commands into the build process by providing specially crafted package names by the user. This vulnerability is caused by the lack of proper validation of special characters in package names before they are used as arguments in the make utility. By exploiting this vulnerability, an attacker can create malicious firmware images on the server, signed with a correct build key.
- The vulnerability in the util.py library is caused by SHA-256 hashes used to check for already built firmware images being truncated to 12 characters, which significantly reduced the level of entropy and allowed an attacker to create a malicious image whose hash matches a legitimate image through collision analysis. Combined with the vulnerability in Imagebuilder, the hash issue could be exploited by an attacker to 'pollute' the ASU Server cache and store malicious images served in response to requests from ordinary users.
The change that allowed the possibility of an attack was made on July 8. The problem was resolved on December 4. For the operation of the ASU service, separate serverid, non-overlapping with the main build systems of the project, isolated from OpenWrt Buildbot, and not having access to confidential resources such as SSH keys and certificates for generating digital signatures.
It is claimed that the OpenWrt developers found no signs of compromise in the project's infrastructure, but as a precaution, they completely reinstalled the systems on which the vulnerable components were running. The problem did not affect the official images distributed through the website downloads.openwrt.org, and the analysis of build logs found no evidence of malicious requests. However, since the ASU servers automatically clean builds older than 7 days, it was impossible to audit old builds.
The likelihood of exploiting the identified vulnerabilities in practice to distribute malicious images through the OpenWrt infrastructure is assessed by OpenWrt representatives as close to zero; nevertheless, ASU users are recommended to replace OpenWrt firmware on their devices with the same version.
Allikas: opennet.ru
