安全资讯|Zyxel解决了NAS设备中的0day（附英文原文）

本文由白帽技术与网络安全整理翻译

技术供应商Zyxel解决了几个网络连接存储(NAS)设备的一个关键漏洞，这些设备已经在野外被利用。

Zyxel已经发布了安全补丁，以解决这个重要的远程代码执行漏洞，该漏洞被称为CVE-2020-9054，它会影响多个NAS设备。该漏洞可能被未经身份验证的攻击者利用，它驻留在weblogin.cgi可执行文件中，不能正确地清除传递给它的用户名参数。

攻击者可以在传递给可执行文件的用户名中包含某些字符来触发漏洞，并使用webserver的特权进行命令注入。

“多个ZyXEL网络附加存储（NAS）设备包含一个预身份验证命令注入漏洞，该漏洞可能允许未经身份验证的远程攻击者在易受攻击的设备上执行任意代码。”（ reads the advisory published by CERT/CC.）

ZyXEL NAS设备通过使用weblogin.cgi . CGI可执行文件来实现身份验证。此程序未能正确地清除传递给它的用户名参数。如果用户名参数包含某些字符，它可以允许使用在ZyXEL设备上运行的web服务器的特权进行命令注入。

专家解释说，ZyXEL NAS设备包括一个setuid实用程序，可用于运行具有根特权的任何命令。

CERT / CC的专家警告此问题的有效漏洞利用代码在线可用性，因此，他们创建了PoC漏洞利用，以关闭受影响的ZyXEL设备。

据著名的调查员布莱恩·克雷布斯（Brian Krebs）说，一个可利用的漏洞利用程序可以在地下论坛上以2万美元的价格出售。Krebs与DHS和CERT / CC的供应商和专家分享了他的发现。

“ Zyxel NAS（网络附加存储）产品受到远程执行代码漏洞的影响。建议用户安装此修补程序或立即按照变通办法提供最佳保护。”

“在运行固件版本5.21和更低版本的Zyxel NAS产品的weblogin.cgi程序中发现了一个远程执行代码漏洞。缺少程序的身份验证可能会让攻击者通过OS命令注入执行远程代码执行，”

攻击者可以通过发送特制的HTTP POST或GET请求来利用此漏洞。如果攻击者没有与设备的直接连接，但他能够欺骗受害者访问恶意网站，则也可能触发此问题。

威胁参与者可以利用此漏洞进行大规模攻击。

“该漏洞非常引人注目，因为它吸引了专门致力于大规模部署勒索软件的组织的兴趣。”克雷布斯写道。“最近的活动表明，以部署勒索软件闻名的攻击者一直在积极测试零日攻击是否可用于目标。” “特别是，霍尔顿说，该漏洞利用正被一群试图将漏洞利用整合到Emotet的坏家伙使用，Emotet是一种强大的恶意软件工具，通常通过垃圾邮件进行传播，该垃圾邮件经常被用来使用包含受害者文件的恶意代码为目标播种。索要赎金。“

Zyxel发布了针对NAS326，NAS520，NAS540和NAS542设备的安全修复程序，但NAS设备NSA210，NSA220，NSA220 +，NSA221，NSA310，NSA310S，NSA320，NSA320S，NSA325和NSA325v2将不会收到任何补丁程序。

“请勿将产品直接暴露在互联网上。如果可能的话，将其连接到安全路由器或防火墙以提供额外的保护。” Zyxel建议。

CERT / CC还提供缓解措施，例如阻止对Web界面（80 / tcp和443 / tcp）的访问，并避免将NAS暴露给Internet。

-------------------------------------------------------------------------

原文阅读

Tech vendor Zyxel addresses a critical vulnerability in several network-attached storage (NAS) devices that is already being exploited in the wild.

Zyxel has released security patches to address a critical remote code execution vulnerability, tracked as CVE-2020-9054, that affects several NAS devices. The flaw can be exploited by an unauthenticated attacker, it resides in the weblogin.cgi CGI executable that doesn’t correctly sanitize the username parameter passed to it.

An attacker could include certain characters in the username passed the executable to trigger the vulnerability and carry out command injection with the privileges of the webserver.

“Multiple ZyXEL network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.” reads the advisory published by CERT/CC.

“ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.”

Experts explained that ZyXEL NAS devices include a setuid utility that can be used to run any command with root privileges.

Experts at CERT/CC warn of the availability online of working exploit code for this issue, for this reason, they have created a PoC exploit that power down affected ZyXEL devices.

According to the popular investigator Brian Krebs, a working exploit is available for sale on underground forums for $20,000. Krebs shared his discovery with the vendor and the experts at DHS, and CERT/CC.

“Zyxel NAS (Network Attached Storage) products are affected by a remote code execution vulnerability. Users are advised to install the hotfixes or follow the workaround immediately for optimal protection.” reads the advisory published by Zyxel.

“A remote code execution vulnerability was identified in the weblogin.cgi program of Zyxel NAS products running firmware version 5.21 and earlier. Missing authentication for the program could allow attackers to perform remote code execution via OS command injection,”

An attacker could exploit the vulnerability by sending a specially-crafted HTTP POST or GET request. The issue could be also triggered if the attacker does not have direct connectivity to the device, but he is able to trick the victim into visiting a malicious website.

The vulnerability could be exploited by threat actors in the wild for large-scale attacks.

“the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.” wrote Krebs. “recent activity suggests that attackers known for deploying ransomware have been actively working to test the zero-day for use against targets.” “Specifically, Holden said the exploit is now being used by a group of bad guys who are seeking to fold the exploit into Emotet, a powerful malware tool typically disseminated via spam that is frequently used to seed a target with malcode which holds the victim’s files for ransom. “

Zyxel released security fixes for NAS326, NAS520, NAS540, and NAS542 devices, but the NAS devices NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 will not receive any patch because are no longer supported by the vendor

“Do not leave the product directly exposed to the internet. If possible, connect it to a security router or firewall for additional protection,” Zyxel recommends.

CERT/CC also provides mitigations such as blocking access to the web interface (80/tcp and 443/tcp) and avoiding exposing the NAS to the Internet.

Pierluigi Paganini

(SecurityAffairs – hacking, Zyxel)

原文链接：https://securityaffairs.co/wordpress/98461/hacking/zyxel-critical-rce.html