CVE-2023-41346: ASUS RT-AX55 Authentication Vulnerability Allows Command Injection Attacks

In today's era of IoT devices and smart home appliances, ensuring the security of routers and other network devices is of paramount importance. This long-read post describes a new vulnerability (CVE-2023-41346) discovered in ASUS RT-AX55 routers. The vulnerability in these routers’ authentication-related function permits an authenticated remote attacker to execute arbitrary commands on the system, resulting in disruption or termination of services.

Vulnerability Details

The ASUS RT-AX55 router’s authentication-related function possesses a vulnerability in its token-refresh module, which is caused by insufficient filtering of special characters. Researchers have discovered that once authenticated, a remote attacker can exploit this vulnerability to perform a Command Injection attack. By doing so, they can execute arbitrary commands, disrupt the system, or terminate essential services.

This vulnerability has been assigned the CVE-2023-41346 identifier.

Code Snippet

To grasp how this vulnerability can be exploited, let's look at a code snippet that demonstrates the flaw. The following example shows a vulnerable token-refresh function:

function token-refresh(userToken) {
    // (...)
    // Validate userToken and perform other actions
    // (...)
    
    // Insufficient filtering of special characters in userToken
    var command = "refresh_token=" + userToken;
    system(command);
}

In this case, the userToken variable is not properly sanitized before being appended to the command variable. As a consequence, an attacker with a crafted userToken could inject arbitrary commands into the command variable, which would then be executed by the system() function.

Exploitation Details

An attacker would first need to authenticate themselves with the victim's router. Once authenticated, they could exploit the vulnerability as follows:

1. Craft a malicious user token containing special characters and a command injection payload, e.g., userToken = ";[INJECTED_COMMAND];"

Original References

This vulnerability was disclosed by [RESEARCHER_NAME] from [RESEARCHER_AFFILIATION] in their research titled "[RESEARCH_ARTICLE_TITLE]." The complete research document, description of the vulnerability, and proposed mitigation techniques can be found at the following links:

Recommendations and Mitigation

To protect your ASUS RT-AX55 router from this vulnerability, several mitigations should be considered:

1. Update the firmware: Regularly check for and install firmware updates from ASUS that contain vulnerability patches.
2. Use strong authentication: Choose strong, unique usernames and passwords for all your devices to reduce the possibility of unauthorized access.
3. Implement input validation: Encourage ASUS to implement input validation for all user inputs, including token-refresh modules, to filter out special characters and prevent command injection attacks.
4. Segregate your network: Implement network segmentation to limit the exposure of your devices to potential attackers and reduce the impact of a potential attack.
5. Be cautious with public networks: Avoid connecting your router to unknown or public networks that may expose it to potential attacks.

Conclusion

CVE-2023-41346 is a significant vulnerability that can lead to unauthorized access, system disruption, and service termination on ASUS RT-AX55 routers. Users should stay vigilant, implement the recommended mitigations, and ensure that their firmware is kept up-to-date to prevent exposure to this vulnerability. Manufacturers should also recognize the paramount importance of effectively filtering special characters from user inputs to avoid similar vulnerabilities in the future.

Timeline

Published on: 11/03/2023 05:15:29 UTC
Last modified on: 11/13/2023 16:59:38 UTC