The TOTOLINK LR350 wireless router, running firmware version 9.3.5u.6369_B20220309, is found to have a critical post-authentication buffer overflow vulnerability, identified as CVE-2022-44257. The vulnerability occurs due to insufficient validation of user-supplied input to the 'pppoeUser' parameter in the 'setOpModeCfg' function.

In this article, we will walk you through the details about this exploit and see how an attacker could leverage it to execute arbitrary code on the device. We will also look at a code snippet demonstrating the vulnerability, and provide links to the original sources for further reference.

Exploit Details

A buffer overflow vulnerability exists in the TOTOLINK LR350 wireless router due to improper handling of user input to the 'setOpModeCfg' function. This function is responsible for setting the operation mode configuration for the router. The 'pppoeUser' parameter, which is a part of this function, is affected by this vulnerability.

An attacker needs to have valid administrator credentials to trigger this exploit. Once authenticated, an attacker can send a crafted HTTP request to the router with an excessively long 'pppoeUser' value, causing the buffer to overflow. This overflow can lead to memory corruption and, ultimately, arbitrary code execution on the device.

The following code snippet demonstrates the vulnerability in the 'setOpModeCfg' function

void setOpModeCfg(int sock, char *postData, char *tmpbuf)
    char opMode[8], pppoeUser[256], pppoePass[256];                                             Document

    strcpy(pppoeUser, get_cstream_var(postData, tmpbuf, "pppoeUser"));
    ...
}

As we can see, the 'pppoeUser' buffer's size is limited to 256 bytes. However, there is no bound checking when copying the input from the HTTP request into the 'pppoeUser' buffer, which leads to the buffer overflow.

Proof of Concept (PoC)

The following proof of concept demonstrates the exploit. The attacker sends an HTTP POST request with a long 'pppoeUser' parameter value to the '/apply.cgi' endpoint.

POST /apply.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 507

opMode=2&pppoeUser=A*500&pppoePass=testpassword&submitButton=Apply

In this example, the 'pppoeUser' parameter is filled with 500 'A' characters, triggering the buffer overflow vulnerability.

Mitigation

Until TOTOLINK provides a firmware update addressing this vulnerability, administrators are advised to ensure that strong, unique credentials are used for their routers and restrict access to trusted users only.

- Vulnerability Details - CVE-2022-44257
- TOTOLINK Official Website

Conclusion

The CVE-2022-44257 vulnerability can allow an authenticated attacker to exploit a buffer overflow issue, potentially leading to arbitrary code execution on the TOTOLINK LR350 wireless routers. It's essential for administrators of these devices to follow best practices regarding access control and credential management to mitigate the risk until an official fix becomes available. Always keep updated with the latest security updates provided by TOTOLINK and apply patches as soon as they are released.

Timeline

Published on: 11/23/2022 16:15:00 UTC
Last modified on: 11/26/2022 03:44:00 UTC