Recently ASUS patched two issues I discovered in the RT-AC1900P router firmware update functionality. These vulnerabilities could allow for complete compromise of the router and all traffic that traverses it.
Finding 1: Update Accepts Forged Server Certificates (CVE-2020-15498)
The first vulnerability was about accepting untrusted (forged) certificates by the wget program used by the router to fetch the updates from ASUS servers. If you happen to have an ASUS RT-AC1900P using old firmware, you can log in via SSH and grep through the filesystem for a string:
--no-check-certificate
This will yield some shell scripts that perform downloads from the ASUS update servers. A malicious attacker could exploit this lack of certificate checking to force the install of malicious files. While the attacker would have to be adjacent network wise to the vulnerable router to perform the man in the middle attack (MITM), a successful attack could result in a full compromise of the router allowing for complete access to all traffic going through it. The latest firmware does not use this wget option anymore, so the MITM attack is no longer possible.
Finding 2: XSS in Release Notes Dialog Window (CVE-2020-15499)
The second bug ASUS fixed was a cross-site scripting (XSS) vulnerability in the Web Management interface related to firmware updates: the release notes page did not properly escape the contents of the page before rendering it to the user. This means that a legitimate administrator could be attacked by a malicious party using the first MITM finding and chaining it with arbitrary JavaScript code execution. Example of a fake release notes page for this attack:
</textarea>
<script>alert(document.cookie);</script>
<textarea>
ASUS fixed this in the latest firmware so that the release notes page no longer renders arbitrary contents verbatim.
Summary
Since routers like this one typically define the full perimeter of a network, attacks targeting them can potentially affect all traffic in and out of your network. ASUS patched this issue in firmware version 3.0.0.4.385_20253, so please patch as soon as you can.
Trustwave Advisory TWSL2020-004
