Pierluigi Paganini
April 29, 2015
Another smart object was found vulnerable by security experts, it is a popular projector commonly used in classrooms. The manufacturer has discovered several authentication flaws affecting the firmware running on the projector, the vulnerabilities could be exploited by attackers the host network.
The vulnerable firmware (version 0.26) runs on the projector InFocus IN3128HD, as many other Internet of Things devices exposes a web interface to modify its settings. The administration console requires an admin password to access the configuration of the InFocus IN3128HD projector, but an authentication bypass flaw affecting the firmware could allow an attacker to modify any parameters by simply guessing the name of the page (main.html) that users are directed to after they complete a successful login. This means that just using the proper URL an attacker can bypass that login page.
“The InFocus IN3128HD projector web server interface requires an admin password in order to view or modify the device configuration parameters. The vulnerability [CVE-2014-8383] is caused by a user’s ability to bypass the login page (index.html) by knowing the name of the page (main.html) to which a logged user is forwarded after entering the correct password. The restricted pages contain no control whatsoever of logged or unauthenticated users. The login only checks the entered password and does not generate a session cookie if the user logs in correctly. The following URL allows an alternate preauth path to the restricted section” states the researcher with Core Security’s CoreLabs Joaquin Rodriguez Varela.
Once bypassed the authentication mechanism, the attacker could gain and modify network settings (i.e. network mask, DNS server, gateway) or Wi-Fi configuration, including its password.
At this point, it is easy to imagine the consequence for the disclosure of the WiFi password.
Varela highlighted that the firmware also lacks authentication for the “webctrl.cgi.elf” CGI file, used to commit the changes.webctrl.cgi.elf” CGI file, used to commit the changes.
Verela explained that using this file it is possible to change once again the device parameters, including the DHCP setting, and force remotely the reboot of the InFocus IN3128HD projector.
Varela reported the flaws to the InFocus company that claimed the researchers at Core “no longer had any desire to see the advisory.”
In time I’m writing, InFocus still haven’t provided any update for the vulnerable firmware. Waiting for a fix, Core is suggesting owners of InFocus IN3128HD projector to isolate the devices from public networks.
(Security Affairs – InFocus IN3128HD vulnerability, hacking)
