All versions of AsusWRT routers at the time of report to vendor were vulnerable. For previous 376 version see CVE-2017-15655

1. Highly predictable session tokens

CVE: CVE-2017-15654

CVSS v3: 8.3
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
(Attacker needs administrator interaction and a way to overcome administrator IP check - see next point)

Description: The session token is generated for an authenticated user using stdlib rand function. The token generation code looks as follows:

    char *generate_token(void){
       int a=0, b=0, c=0, d=0;
       //char create_token[32]={0};
       memset(gen_token,0,sizeof(gen_token));
       srand (time(NULL));   //VULNERABLE
       a=rand();
       b=rand();
       c=rand();
       d=rand();
       snprintf(gen_token, sizeof(gen_token),"%d%d%d%d", a, b, c, d);
       return gen_token;
    }

The code initializes the random number generator each time a token is generated with router epoch time.

An attacker can guess a token knowing more or less the time the administrator has logged in.

Timeline:

• 17.09.2017 - vendor notified
• 07.11.2017 - vendor releases a fixed version 3.0.0.4.382.18495

2. Not sufficient logged user IP validation

CVE: CVE-2017-15653

CVSS v3: 8.3
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
(Attacker needs the session token to execute any action without IP check - see point above)

Description: An attacker who knows the session token can walkaround the IP verification mechanism by sending requests with a special useragent.

The following PoC will download current router configuration even if issued from a different than the logged user IP address:

    curl "http://ROUTERADDRESS/s.CFG" -H "Cookie: asus_token=TOKEN" -H 'User-Agent: asusrouter-asusrouter-asusrouter-asusrouter'

Timeline:

• 17.09.2017 - vendor notified
• 07.11.2017 - vendor releases a fixed version 3.0.0.4.382.18495

3. Password stored in plain text

CVE: CVE-2017-15656

Description: Asus routers store password in plain text in NVRAM memory. Executing nvram show, or downloading the backup file and decoding it allows anyone to read the administrator password.

Having access to telnet (shell) one can execute:

    nvram show

For reading password from backup file see the exploit below.

Timeline:

• 17.09.2017 - vendor notified
• 03.01.2018 - vendor stated that the NVRAM will be crypted in February this year

4. Logged-in information disclousure

An unauthenticated attacker can retrieve information about a logged-in session (if and who [IP address] is currently logged in). This itself is not a vulnerability but together with the two previous it allows for a easy exploit.

    curl "http://ROUTERADDRESS/Nologin.asp"

Exploiting all together

Taking all the four together it is easy to gain router access by waiting for an administrator login and retrieving the login/password using his token. Finally it is possible to download the backup file and read the administrator login and password. A ready script is attached to this message.

Suggested CVSS v3 for all three (1-3): 9.6
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Video:

Exploit: asuswrt.tar.gz