CVE-2019-20215
published 2020-01-29CVE-2019-20215: D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in…
PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
75.11%
99.5th percentile
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-859_firmware | — | — |
| dlink | dir-859_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandM-SEARCH * HTTP/1.1
Host:239.255.255.250: 1900
ST:urn:device:1;`<cmd>`
Man:"ssdp:discover"
MX:2
↗
- →Detect exploitation attempts by monitoring UDP traffic on port 1900 for M-SEARCH packets containing shell metacharacters (backticks, semicolons) in the ST (Search Target) header field, particularly patterns matching 'urn:*;`' or 'uuid:`'. ↗
- →The exploit uses two injection vectors via the ST header: URN-based ('urn:device:1;`cmd`') and UUID-based ('uuid:`cmd`'). Both should be covered in detection signatures. ↗
- →The vulnerability is in ssdpcgi() where HTTP_ST is mishandled via strstr(); monitor for process spawning from ssdpcgi or /htdocs/cgibin on D-Link devices, especially child shell processes. ↗
- →The Metasploit module defaults to MIPSBE architecture with a meterpreter_reverse_tcp payload and uses wget or echo as the cmdstager flavor; monitor for outbound wget connections or unusual echo-based file writes following UPnP traffic on affected devices. ↗
- ·The exploit targets UDP port 1900 (UPnP/SSDP); network-level blocking or rate-limiting of inbound UDP/1900 from untrusted sources will mitigate exploitation. UPnP is enabled by default on most affected D-Link devices. ↗
- ·Staged meterpreter payloads may cause crashes on target; attackers are likely to use stageless payloads, which may affect payload size and delivery method signatures. ↗
- ·Some D-Link devices lack the wget command; attackers may fall back to echo-based cmdstager, altering the post-exploitation payload delivery pattern. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)
exploitdb·2020-02-10
CVE-2019-20215 D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)
D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi',
'Description' => %q{
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi.
},
'Author' =>
[
's1kr10s',
'secenv'
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2019-20215'],
['URL', 'https://medium.com/@s1kr10s/2e799acb8a73']
],
'DisclosureDate' => 'Dec 24 2019',
'Privileged' => true,
'Platform' => 'linux',
'Arch' => ARCH_MIPSBE,
'DefaultOptions' =>
{
'PAYLOAD' => 'linux/mipsbe/meterpreter_reverse_tcp',
'CMDSTAGER::FLAVOR' => 'wget',
'RPORT' => '1900'
},
Metasploit
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi
metasploit
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi.
Metasploit
D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.
metasploit
D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.
D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.
A command injection vulnerability exists in multiple D-Link network products, allowing an attacker to inject arbitrary command to the UPnP via a crafted M-SEARCH packet. Universal Plug and Play (UPnP), by default is enabled in most D-Link devices, on the port 1900. An attacker can perform a remote command execution by injecting the payload into the `Search Target` (ST) field of the SSDP M-SEARCH discover packet. After successful exploitation, an attacker will have full access with `root` user privileges. NOTE: Staged meterpreter payloads might core dump on the target, so use stage-less meterpreter payloads when using the Linux Dropper target. Some D-Link devices do not have the `wget` command
No writeups or analysis indexed.
http://packetstormsecurity.com/files/156250/D-Link-ssdpcgi-Unauthenticated-Remote-Command-Execution.htmlhttps://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-rce-in-ssdpcgi-http-st-cve-2019-20215-en-2e799acb8a73https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147http://packetstormsecurity.com/files/156250/D-Link-ssdpcgi-Unauthenticated-Remote-Command-Execution.htmlhttps://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-rce-in-ssdpcgi-http-st-cve-2019-20215-en-2e799acb8a73https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
2020-01-29
Published