Security Advisory

IS-2010-002 - Linksys WAP54Gv3 Remote Debug Root Shell



Advisory Information
--------------------
Published:
2010-06-08

Updated:
2010-06-08

Manufacturer: Linksys
Model: WAP54G
Hardware version: v3.x
Firmware version: ver.3.05.03 (Europe)
          ver.3.04.03



Vulnerability Details
---------------------
Class:
Remote Code Execution


Public References:
Not Assigned


Platform:
Succesfully tested on Linksys WAP54Gv3 loaded with firmware version
Ver.3.05.03 (Europe)
Vulnerability present also on firmware ver.3.04.03 (US)
Other models and/or firmware versions may be also affected.


Background Information:
Linksys WAP54G is a wireless access points that allow wireless clients
connectivity to wired networks.
Supported 802.11b and 802.11g protocols, with data rates up to 54Mbit/s.


Summary:
A debug interface allowing for the execution of root privileged shell
commands is available on dedicated web pages on the device.
Hardcoded credentials, that cannot be changed by user, can be used for
accessing the debug interface.


Details:
A web page that allows executing shell commands on device is available
at the following URLs:

http://AP_IP_ADDR/Debug_command_page.asp 
http://AP_IP_ADDR/debug.cgi 

where AP_IP_ADDR is the IP address of the device.
Authentication is required in order to access the aforementioned URLS,
but the configured admin credentials used for accessing the
administration interface, will not be sufficient for a successful
authentication.
The following credentials must be supplied in order to be authenticated:

User: Gemtek
Password: gemtekswd

and access a debug web page that can be used for submitting shell
commands via a dedicated web form.
Such credentials are hardcoded in the firmware and cannot be changed by
user by any means available on the administration web interface.
They can be used for accessing only the debug web pages specified above,
and cannot be used for authenticating to the administration web interface.

Submitted commands are included within data1 form variable, sent via a
POST request to the web server, and executed with the httpd web server
privileges, that is running with root privileges on the system, allowing
for complete remote control of the access point.
Two additional variables, data2 and data3 are processed by web server
code, but are not present in the form on the debug web page.
Command injection is also possible in data2 and data3 payload by using
typical shell commands concatenation.

Impacts:
Remote access and modifications to access point settings and configuration.
Remote extraction of sensitive information such as credentials for
logging into the administration interface, Wi-FI SSIDs and passphrases.
Remote download and execution of malicious applications.
"Remote blind" attacks, where malicious web pages are used by an
attacker over the Internet to execute code on a victim access point with
private addressing, by leveraging an user browser as a 3rd party
"reflector", may be also possible.
Effectiveness of the aforementioned attack scenarios is increased
because of the hardcoded credentials.


Solutions & Workaround:
Not available



Additional Information
----------------------
Timeline:
09/11/2009: Requested Point of Contact to Linksys
10/11/2009: Received Point of Contact
10/11/2009: Vulnerability details sent
11/12/2009: Received clarification request on firmware version
11/12/2009: Additional details sent
16/01/2010: Requested update on vulnerability status.
----------- No update received -----------
26/05/2010: Vulnerability disclosed at CONFidence 2010
08/06/2010: This advisory


Additional information available at http://www.icysilence.org