How We Found CVE-2022-38132 –
Linksys MR8300 Zero Day

What You’ll Learn

• Vulnerability Identification: Learn about the command injection flaw in the Linksys MR8300 router that allowed for remote code execution.
• Exploitation Mechanics: Understand how improper input sanitization in the DDNS service can be manipulated to gain unauthorized access and control.
• Mitigation and Prevention: Discover the importance of firmware updates and continuous vulnerability scanning to protect connected devices.
• Security Practices: Recognize the critical need for robust input validation and secure coding practices to prevent similar vulnerabilities in other devices.

Recently, we discovered a new zero-day vulnerability in Linksys MR8300 router, affecting the latest version 1.0 of the router’s firmware (See: Roman Explains). After reporting and disclosing the issue with Linksys, the vulnerability was fixed, and the newer firmware version is no longer vulnerable. As a CVE numbering authority, we also reported this issue, now published as CVE-2022-38132, with a CVE score of 8.8.

The vulnerability is an easy-to-exploit Command Injection that can be triggered from the web configuration interface of the router and could allow remote code execution.
In this article, we will present the end-to-end scenario of the vulnerability and the possible exploitation.

Background

Dynamic DNS (DDNS) service is a method of automatically updating a named server in the DNS for devices that change their location, configuration, or IP address frequently. Our router supports this functionality, in its web interface, post-authentication.

Registration to the DDNS service web page looks like this:

The user provides a user name, password, and hostname to register with one of the DDNS providers. After pressing “Ok” the data is sent to the backend, where it is handled by service_ddns.sh bash script on the router.

Code Analysis

In the service_ddns.sh file, the update_noip_server function is responsible for processing the user’s DDNS information and sending the request to the DDNS provider.

The script fetches the username and password provided by the user and fills them into a URL.

Then the curl command line with the former URL is created:

And eventually, the command line is executed:

The Vulnerability

Improper Input sanitization:

The structure of the constructed URL is very similar to the pattern of https://<ip>:<port>, but in this case, the “@” symbol ensures that the web request will be sent to the dynupdate.no-ip.com domain. However, the ‘#’ symbol could be provided as part of the password. ‘#’ marks a comment line in bash and in curl commands, causing everything after it to be ignored.

Providing:

Will yield:

This allows us to create a request to an arbitrary domain and port, only by specifying username and password, while commenting out the original hard coded domain.

This on its own could lead to various security consequences, but it is still not a remote code execution.

Uploading File to the Router:

The output of the curl command could be redirected to a file on the file system. By using the “-o” flag of curl, it’s possible to download a file from our server to an arbitrary path on the device.

From curl help prompt:

We can provide the following arguments:

Which will yield:

Causing a file from our server to be downloaded to /tmp/strace path on the device. This allows us to overwrite any file in the router’s file system.

Remote Code Execution:

After successfully uploading files from the remote server to the device, our final goal is to obtain reliable code execution on the router.

In the device itself, we found a directory of cron jobs, which run in different constant time intervals.

The directory is

And it’s content is:

Inside the cron.everyminute directory, we found the arp_mon_everyminute.sh bash script file, that is executed every minute on the device.

Providing:

Will yield:

This will overwrite the arp_mon_everyminute.sh file with our script, which will be executed in the router every minute.

However, sending this username and password shows an error message that the password length is too long. Client-side protection against long strings is popular in various web interfaces, yet often possible to bypass, by altering the sent request with tools such as burp suite. Indeed, we saw that in this case, the protection is applied only on the client side, and manually changing the API request made it possible to send the long string of the password to the server.

This way we achieved code execution on the device.

Full Scenario

In our case, we deployed an apache web server at 192.168.1.56 IP, and 5443 port. Accessing to `win.sh` URL on the server will return the following bash script as simple text:

From the router’s web page, using burp suite, we captured the API request to SetDDNSSettings,  and edited it this way:

Resulting with the following request:

We sent the request, and after a minute we saw the newly created file in the router’s file system:

Mitigation for CVE-222-38132

Linksys issued a fix to the vulnerability, in the 1.1 version of their firmware.

The firmware is available to download from this link. It’s recommended to update the device firmware to the newest release version.

Wrap Up

The firmware has a command injection vulnerability, that can be triggered by the user, by providing a specially crafted username and password on the DDNS registration page. This can lead to downloading a file from a malicious remote server, overwriting any file on the router’s file system, and ultimately executing the file on the device using the cron job mechanism.

This is yet another example of the importance of updating the software versions in our connected devices. Continuously scanning the software components that make up our firmware to detect outdated and vulnerable components is critical to ensure the safety of our connected products and devices.

Key Takeways

• Critical Vulnerability Identified: CVE-2022-38132 is a severe command injection vulnerability in the Linksys MR8300 router, allowing potential remote code execution.
  Exploitation Path: The vulnerability can be exploited through the router’s DDNS registration page, leading to arbitrary file uploads and code execution.
  Firmware Update Required: Users should immediately update to the latest firmware version (1.1) to mitigate this vulnerability.
  Client-Side Protections Are Insufficient: The exploitation bypassed client-side validation, highlighting the need for robust server-side security measures.
  Ongoing Vigilance Needed: Regular firmware updates and vulnerability scans are essential to maintaining the security of connected devices.