| 标题 | ST Engineering iDirect Evolution/Velocity WebServer Evolution 14.0.3-21.0.3.3; Velocity 1.6.1.8-3.3.2.3 HTTP Response Header Injection / Open Redirect |
|---|
| 描述 | iDirect WebServer /authorize success CRLF header injection and open redirect
## 2. Vulnerability Summary
- **Internal Tracking ID:** IDIRECT-WEBSERVER-CRLF-OPENREDIRECT-001
- **VulnDB ID:** (Pending Assignment)
- **CVE ID:** (Pending Assignment)
- **Vulnerability Class:** CWE-113; CWE-601
- **Vulnerability Type:** HTTP Response Header Injection / Open Redirect
- **Severity:** 6.1 (Medium)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- **Attack Prerequisites:** Pre-authentication; victim interaction for redirect/header abuse
- **Verification Status:** CONFIRMED
- **Verification Evidence:** QEMU dynamic reproduction on 7 webserver builds with raw HTTP responses
## 3. Affected Vendor / Product
- **Vendor:** iDirect
- **Product:** Evolution/Velocity WebServer
- **Affected Version / Firmware:** Evolution 14.0.3-x.x.x.x; Velocity x.x.x.x-x.x.x.x confirmed sample range
- **Affected Component:** usr/sbin/webserver /authorize?logout&success=
- **Architecture:** PowerPC 32-bit MSB webserver samples
## 4. Description
在已有 iDirect 固件集合中，7 个 `usr/sbin/webserver` 样本均可在 QEMU 下启动并复现同一个预认证问题：
- `success=` 可控制 `Location`，形成 Open Redirect。
- `success=%0d%0aHeader: value` 会被解码后直接写入响应头，形成 CRLF Header Injection / HTTP Response Splitting。
这说明漏洞不是单一版本偶发现象，而是 iDirect WebServer 同族通用缺陷，覆盖 Evolution X7、Evolution unknown、Velocity unknown 多条固件线。
## 5. Technical Details
- 批量验证 CSV：`E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_webserver_family_verify.csv`
- 批量原始响应目录：`E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_webserver_family_verify\`
- 重试确认响应目录：`E:\study\项目\genefuzz\论文\FirmRec\NEW_0DAY_HUNT_20260702\idirect_webserver_family_verify_retry\`
## 6. Proof of Concept / Reproduction
```bash
# Open Redirect
curl -k -i 'https://<device>/authorize?logout&success=https://evil.test/fam'
# CRLF Header Injection
curl -k -i 'https://<device>/authorize?logout&success=%0d%0aX-FirmRec-Family:%20yes'
```
## 7. Security Impact
见下方完整源报告。
## 8. Remediation Recommendation
1. `success` 只允许站内相对路径，例如 `/login.html`、`/apilogin.html`。
2. 拒绝 `http://`、`https://`、`//host/path`、`javascript:` 等外部或协议型跳转。
3. 在写入 HTTP 头前过滤 `\r`、`\n`、NUL 与其他控制字符。
4. logout 场景建议直接使用固定跳转路径，不从请求参数读取跳转地址。
## 9. Discovery / Verification
- **Discovery Method:** manual dynamic QEMU verification after FirmRec-guided iDirect hunt
- **Submission Pack Date:** 2026-07-07
- **Source Report:** `NEW_0DAY_HUNT_20260702/IDIRECT_FAMILY_CONFIRMED_CRLF_OPEN_REDIRECT.md`
- **Final Curation Decision:** included as confirmed / submit-ready for VulnDB.
## 10. Disclosure Timeline
| Date | Event |
| ---- | ---------------------------------- |
| TBD | Vendor notification / coordination |
| TBD | CVE/VulnDB assignment |
| TBD | Public disclosure |
## 11. Source Report / Full Original Material
> The following source content is preserved for traceability. The normalized fields above are the VulnDB form fields to submit.
## 结论
在已有 iDirect 固件集合中，7 个 `usr/sbin/webserver` 样本均可在 QEMU 下启动并复现同一个预认证问题：
- `success=` 可控制 `Location`，形成 Open Redirect。
- `success=%0d%0aHeader: value` 会被解码后直接写入响应头，形成 CRLF Header Injection / HTTP Response Splitting。
这说明漏洞不是单一版本偶发现象，而是 iDirect WebServer 同族通用缺陷，覆盖 Evolution X7、Evolution unknown、Velocity unknown 多条固件线。
## 已动态确认样本
| # | 固件目录 | webserver | 状态 | Open Redirect | CRLF |
| ---- | -------------------------------------------- | ------------------------------------------------------- | --------- | ------------- | ---- |
| 1 | `idirect_evolution_unknown_21.0.3.3_unknown` | `tag1b_3_92afaaaf21832531__429457__usr_sbin_webserver` | confirmed | yes | yes |
| 2 | `idirect_evolution_x7_14.0.3_unknown` | `tag0b_9_8e28f4f899e81226__22C6F4__usr_sbin_webserver` | confirmed | yes | yes |
| 3 | `idirect_evolution_x7_15.0.5.1_unknown` | `tag1_26_51438bc7ad569464__177742__usr_sbin_webserver` | confirmed | yes | yes |
| 4 | `idirect_evolution_x7_21.0.3.0_unknown` | `tag0b_26_54b747081396ad0c__41D7C3__usr_sbin_webserver` | confirmed | yes | yes |
| 5 | `idirect_velocity_unknown_1.6.1.8_unknown` | `s6_4_85_d9812718d933eac6__1EE__._usr_sbin_webserver` | confirmed | yes | yes |
| 6 | `idirect_velocity_unknown_2.0.1.2_rootfs` | `s6_2_145_800d791c6d8b6557__890B__usr_sbin_webserver` | confirmed | yes | yes |
| 7 | `idirect_velocity_unknown_3.3.2.3_rootfs` | `s6_2_185_fa65d58c58660661__956B__usr_sbin_webserver` | confirmed | yes | yes |
## 统一 PoC
```bash
# Open Redirect
curl -k -i 'https://<device>/authorize?logout&success=https://evil.test/fam'
# CRLF Header Injection
curl -k -i 'https://<device>/authorize?logout&success=%0d%0aX-FirmRec-Family:%20yes'
```
## 代表性响应
```http
HTTP/1.1 302 Found
Set-Cookie: session=; Max-Age=0; secure
Location:
X-FirmRec-Family: yes
Connection: close
Content-Length: 0
```
## 漏洞定性
- 认证要求：预认证
- 触发入口：HTTPS 管理服务 `/authorize`
- 参数：`success`
- 类型：Open Redirect + HTTP Response Header Injection / Response Splitting
- 风险：钓鱼、Cookie 注入、代理/缓存污染、与其他 Web/API 漏洞组合利用
## 修复建议
1. `success` 只允许站内相对路径，例如 `/login.html`、`/apilogin.html`。
2. 拒绝 `http://`、`https://`、`//host/path`、`javascript:` 等外部或协议型跳转。
3. 在写入 HTTP 头前过滤 `\r`、`\n`、NUL 与其他控制字符。
4. logout 场景建议直接使用固定跳转路径，不从请求参数读取跳转地址。 |
|---|
| 来源 | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/IDIRECT-WEBSERVER-CRLF-OPENREDIRECT-001-vulndb.md |
|---|
| 用户 | ST4R0003 (UID 99608) |
|---|
| 提交 | 2026-07-17 19時15分 (2 月前) |
|---|
| 管理 | 2026-09-21 07時54分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408071 [ST Engineering iDirect Evolution/Velocity WebServer Evolution 直到 20260717 HTTP Header /usr/sbin/webserver authorize 成功 Redirect] |
|---|
| 积分 | 20 |
|---|