D-Link DGL-5500/DIR-835/DIR-855L 1.02b18 /hnap.cgi information disclosure

Summaryinfo

A vulnerability was found in D-Link DGL-5500, DIR-835 and DIR-855L 1.02b18. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file /hnap.cgi. The manipulation leads to information disclosure. Furthermore, an exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in D-Link DGL-5500, DIR-835 and DIR-855L 1.02b18 (Router Operating System). This issue affects an unknown function of the file /hnap.cgi. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality.

The weakness was published 05/22/2014 by Kyle Lovett as File 126779 as not defined advisory (Packetstorm). It is possible to read the advisory at packetstormsecurity.com. The vendor was not involved in the public release. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK. The advisory points out:

But more importantly, an unauthenticated user can browse directly to http://<IP>/cgi/ssi/ which will offer a download of the device's ELF MBS MIPS file. The file contains most of the devices internal working structure and sensitive information. These particular routers use a MSB EM_MIPS Processor and it does contain executable components. The file can be accessed through at least one known cgi file, however there maybe others. Although no known publicly working example exist to my knowledge, unpatched devices are susceptible to injection of malicious code and most likely susceptible to a payload which could deploy a self-replicating worm.

A public exploit has been developed by Kyle Lovett in HTTP GET Request and been published 4 days after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 32 days. During that time the estimated underground price was around $5k-$25k. The code used by the exploit is:

curl -s http://<IP>:8080/HNAP1/

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (93615), Exploit-DB (33520), SecurityFocus (BID 67416†) and OSVDB (106807†). securityadvisories.dlink.com is providing further details. Similar entries are available at VDB-13473 and VDB-13474. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DGL-5500
• DIR-835
• DIR-855L

Version

• 1.02b18

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion