PT-2020-1833 · D Link · D-Link Dir-859

Miguel Mendez Z + 3 · Published 2020-01-28 · Updated 2020-02-07 · CVE-2019-20215

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions 1.05 through 1.06B01 Beta01

Description The issue allows remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters. This is due to the lack of neutralization of special elements used in the operating system command.

Recommendations For D-Link DIR-859 versions 1.05 through 1.06B01 Beta01, as a temporary workaround, consider disabling the ssdpcgi() function in /htdocs/cgibin until a patch is available. Restrict access to the /htdocs/cgibin directory to minimize the risk of exploitation. Avoid using the urn: service/device in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-01106

CVE-2019-20215

Affected Products

D-Link Dir-859

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_upnp_msearch_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_dir859_exec_ssdpcgi.rb · Exploit
• 🔥 https://medium.com/@s1kr10s/d-link-dir-859-unauthenticated-rce-in-ssdpcgi-http-st-cve-2019-20215-en-2e799acb8a73 · Exploit
• 🔥 https://exploit-db.com/exploits/48037 · Exploit
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20215 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01106 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-20215 · Security Note
• https://t.me/cvenotify/584 · Telegram Post
• https://packetstormsecurity.com/files/156250/D-Link-ssdpcgi-Unauthenticated-Remote-Command-Execution.html · Note
• https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-rce-in-ssdpcgi-http-st-cve-2019-20215-en-2e799acb8a73 · Note
• http://packetstormsecurity.com/files/156250/D-Link-ssdpcgi-Unauthenticated-Remote-Command-Execution.html · Note