Classic Stack Based Buffer Overflow in D-LINK Firmware DAP 1520

Loginsoft-2020-1006

23 July, 2020

CVE Number

CVE-2020-15892

CWE

CWE-121: Stack-based Buffer Overflow

Product Details

The DAP-1520 Wireless AC750 Dual Band Range Extender is a portable Wireless Range Extender that lets you expand an existing wireless network’s coverage area. You can place it anywhere in your home to increase the range of your wireless network. It’s unobtrusive, compact design provides flexible placement and Next-generation AC750 wireless performance.

‍URL:https://legacy.us.dlink.com/pages/product.aspx?id=c9525c84034642bab9e2893b9b6d5134

Vulnerable Firmware Versions

1.0.8 & 1.10B04

Hardware

Ax

Vulnerability Details

A classic stack-based buffer overflow exists in D-link DAP 1520 access point, in the `ssi` binary, leading to arbitrary command execution.

SYNOPSIS

Whenever a user performs a login action from the web interface, the request values are being forwarded to the `ssi` binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters.The problem is that validation is being done on the client-side, hence it can be bypassed when an attacker manages to intercept the login request (POST based) & tampers the vulnerable parameter (`log_pass`), to a larger length, the request will be forwarded to the webserver. The same weakness can be taken advent of in order to carry out a stack-based overflow.Few other POST Variables, being transferred as part of the login request are also vulnerable, which are `html_response_page` & `log_user`.

Analysis

Payload: ‘a’* 256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaRequest:URL – http://192.168.0.1/apply.cgiPOST Data -html_response_page=post_result.xml&login_name=YWRtaW4%3D&html_response_message=just_login&log_pass=$Payload&login_n=admin&action=do_graph_auth&tkn=1748304150&tmp_log_pass=ss&tmp_log_pass_auth=&graph_code=&session_id=4372&gcode_base64=

Exploitation:

In a regular scenario, an attacker can be anyone connected to the network & able to access the router login page. He can inject the payload into the vulnerable fields from the web interface & perform command execution.The attack can also be carried out remotely, by enticing the victim to visit a crafted URL, triggering the request along with the injected payload via CSRF attack.

Mitigation

• Length check should be done on the server side.
• Memory should be dynamically allocated, when the input is not trusted.

Vendor Disclosure: 9 february 2019

Credit

Discovered by ACE Team - Loginsoft