Vulnerabilities 2008

PR07-40 Authentication Bypass, Passwords Leakage and SNMP Injection on 3Com AP 8760

• Advisory publicly released: Friday, 14 November 2008
• Vulnerability found: Tuesday, 6 November 2007
• Vendor informed: Friday, 2 May 2008
• Severity level: Medium

• Credits
  Adrian Pastor of ProCheckUp Ltd (www.procheckup.com).
• Description
  See below
• Proof of concept
  See below
• How to fix
  See below
• Vulnerability #1
  Description:
  The HTTP authentication mechanism of the 3Com AP 8760 works as follows:
  
  1. Router checks if credentials submitted by user are valid
  2. If valid, the router's web interface redirects the user to URLs that should only be available to authenticated admin users
  
  What's important to note is that every time an "authenticated" URL is accessed, there is no authentication data being sent within HTTP requests whatsoever. There are no passwords, or session IDs being submitted at all within HTTP requests. Instead, the AP uses the administrator's source IP address as authentication data.
  
  This means that the authentication state relies on the false assumption that post-authentication URLs won't be known by an attacker and that the attacker and the administrator will not share the same source IP address. By simply accessing administrative URLs in a browser from the same IP address (i.e.: by sharing the same proxy or NATed IP address), the authentication check can be bypassed completely.
  
  Notes:
  
  Although URL paths are different, these issues appear to be similar to those found on other 3com router models:
  
  http://www.securityfocus.com/bid/11408/discuss
  http://seclists.org/vulnwatch/2005/q1/0042.html
  
  
  
  Proof of concept:
  The following is an example of an administrative page that would allow an attacker to change settings:
  
  http://<target_IP>/advanced.htm
• Vulnerability #2
  Description:
  Additionally, sensitive data such as the admin password is returned within certain pages. Although after bypassing the authentication the attacker wouldn't need to know the admin password anyway, this could be handy for a cracker in scenarios such as the following:
  
  1. The authentication bypass is fixed by updating the firmware to a patched version (attacker would still be able to access the device since he/she knows the admin password)
  2. The attacker could try the same password on other servers owned by the same target company since it's a common human weakness to reuse passwords.
  
  
  
  Proof of concept:
  The following URLs return the admin password within 'hidden' form fields:
  
  http://<target_IP>/s_brief.htm
  http://<target_IP>/s.htm
• Vulnerability #3
  Description:
  It's possible to launch SNMP injection attacks. By changing the system name via SNMP, it's possible to inject a persistent XSS payload on several pages including the login page. Thus, the attacker has an opportunity to redirect the admin password to his own site by overwriting the login form's action attribute.
  
  The payload gets returned within the login page's 'title' tag. i.e.:
  
  <title>3Com Wireless 8760 Dual Radio 11a/b/g Access Point PAYLOAD_GOES_HERE%3C/title%3E
  
  Example of snmpset command that changes the AP's system name:
  
  snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE"
• Successfully tested on
  3COM: AP8760: Dual Radio 11a/b/g Access Point, Software v2.1.13b05_sh, Bootrom v1.2.1, Hardware R02
  
  Note: model and firmware info extracted via SNMP from 'SNMPv2-MIB::sysDescr.0' OID.
• Workaround
  No workaround is available for the authentication bypass and passwords leakage issue. SNMP injection can be resolved by disabling SNMP write access.
• BID
  32358
• References
  

  3Com Wireless 8760 Dual-Radio 11a/b/g PoE Access Point
  http://www.3com.com/products/en_US/detail.jsp?pathtype=purchase&tab=features&sku=3CRWE876075

  SNMP Injection
  http://www.procheckup.com/vulnerability_manager/vulnerabilities/paper-04

  
  
• Legal
  Copyright 2008 Procheckup Ltd. All rights reserved.
  
  Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.
  
  Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.