D-Link DIR-816 A2 1.10 B05 /goform/sylogapply handler syslogIp command injection

Summaryinfo

A vulnerability classified as critical has been found in D-Link DIR-816 A2 1.10 B05. Affected by this issue is the function handler of the file /goform/sylogapply. This manipulation of the argument syslogIp as part of HTTP Request causes command injection. This vulnerability is handled as CVE-2018-17064. The attack can be initiated remotely. There is not any exploit available. It is advisable to implement restrictive firewalling.

Detailsinfo

A vulnerability was found in D-Link DIR-816 A2 1.10 B05 (Router Operating System). It has been declared as critical. Affected by this vulnerability is the function handler of the file /goform/sylogapply. The manipulation of the argument syslogIp as part of a HTTP Request leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could lead to command injection via the syslogIp parameter after /goform/clearlog is invoked.

The bug was discovered 09/06/2018. The weakness was released 09/15/2018 (Website). The advisory is shared at github.com. This vulnerability is known as CVE-2018-17064 since 09/15/2018. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/24/2020). MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $5k-$25k.

Proper firewalling of is able to address this issue.

Entries connected to this vulnerability are available at VDB-124085, VDB-124084, VDB-124083 and VDB-124082. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-816 A2

Version

• 1.10 B05

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: X-xxxx Xxxxxx X.xxxxxxx Xx Xxxxxxx Xxxxxxxxx (by pjqwudi)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion