CVE-2017-8411

{"id": "CVE-2017-8411", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-07-02T19:15:10.570", "references": [{"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \"system\" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \"libmailutils.so\" is the one that has the vulnerable function \"sub_1FC4\" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \"receiver1\" is extracted in function \"sub_15AC\" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \"cgibox\" binary at address 0x00023BCC which calls the \"Send_mail\" function in \"libmailutils.so\" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 de D-Link. El dispositivo provee al usuario la capacidad de configurar una carpeta SMB para los recortes de v\u00eddeo grabados por el dispositivo. Al parecer los par\u00e1metros POST pasados ??en esta petici\u00f3n (para probar si las credenciales de correo electr\u00f3nico y el nombre de host enviados al dispositivo funcionan apropiadamente) dan como resultado que sean pasados como comandos a una API de \"system\" en la funci\u00f3n y, por lo tanto, resulten en una inyecci\u00f3n de comandos en el dispositivo. Si la versi\u00f3n del firmware se disecciona con la herramienta binwalk, obtenemos un archivo cramfs-root que contiene el sistema de archivos configurado en el dispositivo que contiene todos los archivos binarios. La biblioteca \"libmailutils.so\" es la que tiene la funci\u00f3n vulnerable \"sub_1FC4\" que recibe los valores enviados por la petici\u00f3n POST. Si abrimos este binario en IDA-pro, notaremos que este sigue un formato ARM en little endian. La funci\u00f3n sub_1FC4 en IDA pro est\u00e1 identificada para recibir los valores enviados en la petici\u00f3n POST y el valor establecido en el par\u00e1metro POST \"receiver1\" se extrae en la funci\u00f3n \"sub_15AC\" que luego se pasa hacia la llamada API del sistema vulnerable. Se accede a la funci\u00f3n de la biblioteca vulnerable en el binario \"cgibox\" en la direcci\u00f3n 0x00023BCC que llama a la funci\u00f3n \"Send_mail\" en el binario \"libmailutils.so\" como se muestra a continuaci\u00f3n, lo que hace que el par\u00e1metro POST vulnerable se transfiera hacia la biblioteca, lo que resulta en el problema de inyecci\u00f3n de comandos ."}], "lastModified": "2024-11-21T03:33:59.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}