Google developer disclosed Zero-Day flaw in TP-Link SR20 Routers

Google security developer Matthew Garrett disclosed a zero-day arbitrary code execution (ACE) vulnerability affecting the TP-Link SR20 routers.

Google security developer Matthew Garrett discovered a zero-day arbitrary code execution (ACE) vulnerability in TP-Link SR20 routers.

The vulnerability in TP-Link SR20 routers could be exploited by potential attackers on the same network to execute arbitrary commands.

Garret immediately reported the flaw to TP-Link, but after 90 days he decided to publicly disclose the issue because the vendor did not reply to him.

“TP-Link routers frequently run a process called “tddp” (TP-Link Device Debug Protocol) as root. It’s had multiple vulnerabilities in the past and the protocol is fairly well documented. Version 1 has no auth, version 2 requires the admin password.” wrote Garrett on Twitter.

The expert explained that the TP-Link Device Debug Protocol (TDDP) allows running two types of commands on the device: type 1 which do not require authentication and type 2 which requires administrator credentials.

“The SR20 still exposes some version 1 commands, one of which (command 0x1f, request 0x01) appears to be for some sort of configuration validation,” he said. “You send it a filename, a semicolon and then an argument.”

The vulnerable router exposes several type 1 commands, including 0x1f, request 0x01 that appears to be for some sort of configuration validation. These commands could allow attackers to send a command containing a filename, a semicolon, and an argument to initiate the exploitation of the issue.

Once the router receives the command, it responds to the requesting machine via Trivial File Transfer Protocol (TFTP) , asks for the filename, imports it to a Lua interpreter, running as root, and sends the argument to the config_test() function within the imported file.

Garret pointed out that the Lua os.execute() method passes a command to be executed by an operating system shell. The Lua interpreter runs as root, giving an unauthenticated attacker the opportunity to get an arbitrary command execution.

While TDDP listens on all interfaces, the default firewall implemented in the routers prevents network access.

Garrett told TP-Link it should “stop shipping debug daemons on production firmware and if you’re going to have a webform to submit security issues then have someone actually respond to it.”

The Google expert also created a proof-of-concept (PoC).

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking,TP-Link SR20 Router)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.