Отправить #894247: ST Engineering iDirect Evolution/Velocity WebServer Evolution 14.0.3-21.0.3.3; Velocity 1.6.1.8-3.3.2.3 HTTP Response Header Injection / Open Redirect

iDirect WebServer /authorize success CRLF header injection and open redirect

## 2. Vulnerability Summary

- **Internal Tracking ID:** IDIRECT-WEBSERVER-CRLF-OPENREDIRECT-001
- **VulnDB ID:** (Pending Assignment)
- **CVE ID:** (Pending Assignment)
- **Vulnerability Class:** CWE-113; CWE-601
- **Vulnerability Type:** HTTP Response Header Injection / Open Redirect
- **Severity:** 6.1 (Medium)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- **Attack Prerequisites:** Pre-authentication; victim interaction for redirect/header abuse
- **Verification Status:** CONFIRMED
- **Verification Evidence:** QEMU dynamic reproduction on 7 webserver builds with raw HTTP responses

## 3. Affected Vendor / Product

- **Vendor:** iDirect
- **Product:** Evolution/Velocity WebServer
- **Affected Version / Firmware:** Evolution 14.0.3-x.x.x.x; Velocity x.x.x.x-x.x.x.x confirmed sample range
- **Affected Component:** usr/sbin/webserver /authorize?logout&success=
- **Architecture:** PowerPC 32-bit MSB webserver samples

## 4. Description

在已有 iDirect 固件集合中，7 个 `usr/sbin/webserver` 样本均可在 QEMU 下启动并复现同一个预认证问题：

- `success=` 可控制 `Location`，形成 Open Redirect。
- `success=%0d%0aHeader: value` 会被解码后直接写入响应头，形成 CRLF Header Injection / HTTP Response Splitting。

这说明漏洞不是单一版本偶发现象，而是 iDirect WebServer 同族通用缺陷，覆盖 Evolution X7、Evolution unknown、Velocity unknown 多条固件线。

## 5. Technical Details

- 批量验证 CSV：`E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_webserver_family_verify.csv`
- 批量原始响应目录：`E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_webserver_family_verify\`
- 重试确认响应目录：`E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_webserver_family_verify_retry\`

## 6. Proof of Concept / Reproduction

```bash
# Open Redirect
curl -k -i 'https://<device>/authorize?logout&success=https://evil.test/fam'

# CRLF Header Injection
curl -k -i 'https://<device>/authorize?logout&success=%0d%0aX-FirmRec-Family:%20yes'
```

## 7. Security Impact

见下方完整源报告。

## 8. Remediation Recommendation

1. `success` 只允许站内相对路径，例如 `/login.html`、`/apilogin.html`。
2. 拒绝 `http://`、`https://`、`//host/path`、`javascript:` 等外部或协议型跳转。
3. 在写入 HTTP 头前过滤 `\r`、`\n`、NUL 与其他控制字符。
4. logout 场景建议直接使用固定跳转路径，不从请求参数读取跳转地址。

## 9. Discovery / Verification

- **Discovery Method:** manual dynamic QEMU verification after FirmRec-guided iDirect hunt
- **Submission Pack Date:** 2026-07-07
- **Source Report:** `NEW_0DAY_HUNT_20260702/IDIRECT_FAMILY_CONFIRMED_CRLF_OPEN_REDIRECT.md`
- **Final Curation Decision:** included as confirmed / submit-ready for VulnDB.

## 10. Disclosure Timeline

| Date | Event |
| ---- | ---------------------------------- |
| TBD | Vendor notification / coordination |
| TBD | CVE/VulnDB assignment |
| TBD | Public disclosure |

## 11. Source Report / Full Original Material

> The following source content is preserved for traceability. The normalized fields above are the VulnDB form fields to submit.

## 结论

在已有 iDirect 固件集合中，7 个 `usr/sbin/webserver` 样本均可在 QEMU 下启动并复现同一个预认证问题：

- `success=` 可控制 `Location`，形成 Open Redirect。
- `success=%0d%0aHeader: value` 会被解码后直接写入响应头，形成 CRLF Header Injection / HTTP Response Splitting。

这说明漏洞不是单一版本偶发现象，而是 iDirect WebServer 同族通用缺陷，覆盖 Evolution X7、Evolution unknown、Velocity unknown 多条固件线。

## 已动态确认样本

| # | 固件目录 | webserver | 状态 | Open Redirect | CRLF |
| ---- | -------------------------------------------- | ------------------------------------------------------- | --------- | ------------- | ---- |
| 1 | `idirect_evolution_unknown_21.0.3.3_unknown` | `tag1b_3_92afaaaf21832531__429457__usr_sbin_webserver` | confirmed | yes | yes |
| 2 | `idirect_evolution_x7_14.0.3_unknown` | `tag0b_9_8e28f4f899e81226__22C6F4__usr_sbin_webserver` | confirmed | yes | yes |
| 3 | `idirect_evolution_x7_15.0.5.1_unknown` | `tag1_26_51438bc7ad569464__177742__usr_sbin_webserver` | confirmed | yes | yes |
| 4 | `idirect_evolution_x7_21.0.3.0_unknown` | `tag0b_26_54b747081396ad0c__41D7C3__usr_sbin_webserver` | confirmed | yes | yes |
| 5 | `idirect_velocity_unknown_1.6.1.8_unknown` | `s6_4_85_d9812718d933eac6__1EE__._usr_sbin_webserver` | confirmed | yes | yes |
| 6 | `idirect_velocity_unknown_2.0.1.2_rootfs` | `s6_2_145_800d791c6d8b6557__890B__usr_sbin_webserver` | confirmed | yes | yes |
| 7 | `idirect_velocity_unknown_3.3.2.3_rootfs` | `s6_2_185_fa65d58c58660661__956B__usr_sbin_webserver` | confirmed | yes | yes |

## 统一 PoC

```bash
# Open Redirect
curl -k -i 'https://<device>/authorize?logout&success=https://evil.test/fam'

# CRLF Header Injection
curl -k -i 'https://<device>/authorize?logout&success=%0d%0aX-FirmRec-Family:%20yes'
```

## 代表性响应

```http
HTTP/1.1 302 Found
Set-Cookie: session=; Max-Age=0; secure
Location:
X-FirmRec-Family: yes
Connection: close
Content-Length: 0
```

## 漏洞定性

- 认证要求：预认证
- 触发入口：HTTPS 管理服务 `/authorize`
- 参数：`success`
- 类型：Open Redirect + HTTP Response Header Injection / Response Splitting
- 风险：钓鱼、Cookie 注入、代理/缓存污染、与其他 Web/API 漏洞组合利用

## 修复建议

1. `success` 只允许站内相对路径，例如 `/login.html`、`/apilogin.html`。
2. 拒绝 `http://`、`https://`、`//host/path`、`javascript:` 等外部或协议型跳转。
3. 在写入 HTTP 头前过滤 `\r`、`\n`、NUL 与其他控制字符。
4. logout 场景建议直接使用固定跳转路径，不从请求参数读取跳转地址。

• Источник: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-CRLF-OPENREDIRECT-001-vulndb.md
• Пользователь: ST4R0003 (UID 99608)
• Представление: 17.07.2026 19:15 (2 месяцы назад)
• Модерация: 21.09.2026 07:54 (2 months later)
• Статус: принято
• Запись VulDB: 408071 [ST Engineering iDirect Evolution/Velocity WebServer Evolution до 20260717 HTTP Header /usr/sbin/webserver authorize Успех Redirect]
• Баллы: 20