Google developer disclosed Zero-Day flaw in TP-Link SR20 Routers

Google security developer Matthew Garrett disclosed a zero-day arbitrary code execution (ACE) vulnerability affecting the TP-Link SR20 routers.

Google security developer Matthew Garrett discovered a zero-day arbitrary code execution (ACE) vulnerability in TP-Link SR20 routers.

The vulnerability in TP-Link SR20 routers could be exploited by potential attackers on the same network to execute arbitrary commands.

Garret immediately reported the flaw to TP-Link, but after 90 days he decided to publicly disclose the issue because the vendor did not reply to him.

It's been over 90 days since I reported it and @TPLINK never responded, so: arbitrary command execution on the TP-Link SR20 smart hub and router (and possibly other TP-Link device)

— Matthew Garrett (@mjg59@nondeterministic.computer) (@mjg59) March 28, 2019

“TP-Link routers frequently run a process called “tddp” (TP-Link Device Debug Protocol) as root. It’s had multiple vulnerabilities in the past and the protocol is fairly well documented. Version 1 has no auth, version 2 requires the admin password.” wrote Garrett on Twitter.

The expert explained that the TP-Link Device Debug Protocol (TDDP) allows running two types of commands on the device: type 1 which do not require authentication and type 2 which requires administrator credentials.

“The SR20 still exposes some version 1 commands, one of which (command 0x1f, request 0x01) appears to be for some sort of configuration validation,” he said. “You send it a filename, a semicolon and then an argument.”

The vulnerable router exposes several type 1 commands, including 0x1f, request 0x01 that appears to be for some sort of configuration validation. These commands could allow attackers to send a command containing a filename, a semicolon, and an argument to initiate the exploitation of the issue.

Once the router receives the command, it responds to the requesting machine via Trivial File Transfer Protocol (TFTP) , asks for the filename, imports it to a Lua interpreter, running as root, and sends the argument to the config_test() function within the imported file.

Garret pointed out that the Lua os.execute() method passes a command to be executed by an operating system shell. The Lua interpreter runs as root, giving an unauthenticated attacker the opportunity to get an arbitrary command execution.

While TDDP listens on all interfaces, the default firewall implemented in the routers prevents network access.

Garrett told TP-Link it should “stop shipping debug daemons on production firmware and if you’re going to have a webform to submit security issues then have someone actually respond to it.”

The Google expert also created a proof-of-concept (PoC).

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking,TP-Link SR20 Router)

[adrotate banner=”5″]

[adrotate banner=”13″]