Internet Radio auna IR-160 SE UIProto DoS / XSS / Missing Authentication – Torchsec
It uses the firmware UIProto, different versions of which can also be
found in many other radios.
1. The firmware offers a rudimentary web API that can be reached on the
local network on port 80. This API is completely unauthenticated,
allowing anyone to control the radio over the local network. (already
known as CVE-2019-13474, but relevant for the other two findings) [1]
[2] [3]
2. The web UI does not encode user input, resulting in a XSS
vulnerability, e.g. when changing the device name as follows:
http://192.168.178.93/set_dname?name=>
3. The firmware crashes when sending a device name longer than 84
characters. Some parts of the firmware will recover afterwards and music
will play again after a few seconds, but the service on port 80 remains
borked until the radio is reset using the switch on the back. This may
or may not be a memory corruption vulnerability. I don't feel like
analyzing this any further, but it certainly looks kinda fucked.
.../set_dname?name=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
For other vulnerabilities in UIProto see CVE-2019-13473 and
CVE-2019-13474 discovered by Benjamin K.M. These reports also mention
other devices that are possibly affected by this as well.
Also, if anyone knows how to re-enable telnetd on the patched version of
UIProto, please let me know!
Love,
naphthalin
[1] https://github.com/kayrus/iradio
[2] https://sites.google.com/site/tweakradje/devices/abeo-internet-radio
[3]
https://www.vulnerability-db.com/?q=articles/2019/09/09/imperial-dabman-internet-radio-undocumented-telnetd-code-execution
Gloss