Starry Station HTTP API JSON Payload PIN 7pk security

Summaryinfo

A vulnerability marked as critical has been reported in Starry Station. Affected is an unknown function of the component HTTP API. Performing a manipulation as part of JSON Payload results in 7pk security (PIN). This vulnerability is known as CVE-2017-13718. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Starry Station (the affected version is unknown). This affects an unknown code of the component HTTP API. The manipulation as part of a JSON Payload leads to a 7pk security vulnerability (PIN). CWE is classifying the issue as CWE-254. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows an attacker to change the Wi-Fi settings and PIN, as well as port forward and expose any internal device's port to the Internet. It was identified that the device uses custom Python code called "rodman" that allows the mobile appication to interact with the device. The APIs that are a part of this rodman Python file allow the mobile application to interact with the device using a secret, which is a uuid4 based session identifier generated by the device the first time it is set up. However, in some cases, these APIs can also use a security code. This security code is nothing but the PIN number set by the user to interact with the device when using the touch interface on the router. This allows an attacker on the Internet to interact with the router's HTTP interface when a user navigates to the attacker's website, and brute force the credentials. Also, since the device's server sets the Access-Control-Allow-Origin header to "*", an attacker can easily interact with the JSON payload returned by the device and steal sensitive information about the device.

The weakness was published 06/10/2019 as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. This vulnerability is uniquely identified as CVE-2017-13718 since 08/28/2017. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1211 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-136204, VDB-136205, VDB-136206 and VDB-136207. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Starry

Name

• Station

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion