CVE-2023-38945

Executive Summary

CVE-2023-38945 is a critical access control bypass vulnerability affecting multiple Multilaser router models, including the RE160, RE160V, and RE163V. The flaw allows an unauthenticated, remote attacker to gain complete administrative access to the device's web application by simply supplying a crafted URL. This effectively bypasses all authentication and authorization mechanisms, granting full control over the router's configuration, network traffic, and connected devices.

The vulnerability is particularly dangerous due to the lack of a known patch and the public availability of proof-of-concept (PoC) information. The affected devices are commonly used in consumer and small business environments, making them a prime target for botnet recruitment, DNS hijacking, and man-in-the-middle attacks. The CVSS v3.1 base score is 10.0 (Critical), reflecting the ease of exploitation and the severe impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in embedded networking devices. The supply chain risk lies in the distribution of these devices with vulnerable firmware, and the lack of an official patch from the vendor (Multilaser) means end-users are reliant on third-party firmware or device replacement for remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or race conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full read access to device configuration, credentials, and network traffic.
• Integrity (I): High (H) - Full write access to modify firmware, settings, and DNS.
• Availability (A): High (H) - Ability to brick the device or disrupt network connectivity.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full device compromise makes this a top-priority vulnerability for any organization using these routers.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of the affected Multilaser routers. The access control mechanism fails to properly validate user sessions or permissions when processing certain URL patterns. By crafting a specific URL, an attacker can bypass the login page and directly access administrative functions.

The root cause is a failure in the application's routing logic. The web server likely uses a URL-based access control list (ACL) that checks for the presence of a session token. However, the crafted URL causes the server to skip this check, possibly due to:

• Path Traversal: Using ../ sequences to escape the authentication-required directory.
• Direct Object Reference: Accessing administrative endpoints (e.g., /cgi-bin/admin.cgi) without a valid session.
• HTTP Method Manipulation: Using a different HTTP method (e.g., POST vs. GET) that bypasses the ACL.

The exact mechanism is not publicly documented, but the PoC demonstrates that a simple HTTP GET request to a specific path (e.g., /cgi-bin/ or /admin/) grants full access without authentication.

Vulnerable vs. Patched Code

Since no official patch exists, a direct code comparison is not possible. However, the vulnerable code pattern can be inferred:

Vulnerable Code (Conceptual - PHP/Python):

# Vulnerable: Checks only for URL path, not authentication
if "/admin/" in request.path:
    return handle_admin_request(request)
else:
    return handle_public_request(request)

Patched Code (Conceptual):

# Patched: Checks for valid session before any admin action
if "/admin/" in request.path:
    if not is_authenticated(request.session):
        return redirect("/login")
    return handle_admin_request(request)
else:
    return handle_public_request(request)

The fix requires implementing a session validation check on every request to protected resources, rather than relying on URL-based routing alone.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target device: Multilaser RE160, RE160V, or RE163V with vulnerable firmware.
• Network access to the device's web interface (typically on port 80 or 443).
• A web browser or tool like curl.

Exploitation Steps:

1. Identify the target device's IP address (e.g., 192.168.1.1).
2. Send a crafted HTTP GET request to bypass authentication:

   curl -v "http://192.168.1.1/cgi-bin/admin.cgi?cmd=reboot"
   

   Or, if the PoC uses a specific path:

   curl -v "http://192.168.1.1/../../admin/"
   

3. If successful, the response will contain the administrative interface without a login prompt.
4. From here, an attacker can:
   • Change the admin password.
   • Modify DNS settings to redirect traffic.
   • Enable remote access (SSH/Telnet).
   • Download the device configuration file.
   • Upload malicious firmware.

Proof-of-Concept (PoC) Code:

import requests

target = "http://192.168.1.1"
# Example crafted URL - adjust based on actual PoC
bypass_url = f"{target}/cgi-bin/admin.cgi"

response = requests.get(bypass_url, timeout=10)
if "Login" not in response.text and "admin" in response.text:
    print("[+] Access control bypass successful!")
    print(response.text)
else:
    print("[-] Exploit failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to administrative paths (e.g., /cgi-bin/, /admin/) without a preceding login event.
• Look for anomalous URL patterns, such as multiple ../ sequences or direct access to .cgi endpoints.
• Use network intrusion detection systems (NIDS) to alert on the specific exploit patterns.

Hardening:

• Immediate: If possible, disable remote administration and restrict management access to a dedicated VLAN.
• Workaround: Implement a reverse proxy (e.g., Nginx) in front of the router that enforces authentication before forwarding requests.
• Long-term: Replace the device with a patched or alternative router model.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /cgi-bin/admin.cgi or similar paths without a valid session cookie.
• Unusual outbound connections from the router to unknown IPs (e.g., for C2 communication).
• DNS queries to suspicious domains (if DNS settings were hijacked).

Host IOCs (on the router):

• Modified configuration files (e.g., /etc/config/dhcp, /etc/config/network).
• Presence of unauthorized SSH keys in /etc/dropbear/.
• New processes running as root (e.g., a reverse shell).
• Changes to the firmware version or bootloader.

File IOCs:

• Hashes of known malicious firmware images (if available).
• Log entries showing successful login without a password.

Detection Engineering

YARA Rule

rule CVE_2023_38945_Access_Bypass {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2023-38945 on Multilaser routers"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-38945"
    strings:
        $s1 = "/cgi-bin/admin.cgi" ascii wide nocase
        $s2 = "/admin/" ascii wide nocase
        $s3 = "GET /" ascii wide
    condition:
        $s3 and ($s1 or $s2)
}

Sigma Rule

title: CVE-2023-38945 Multilaser Router Access Control Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting administrative endpoints on Multilaser routers without authentication
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/cgi-bin/admin.cgi'
            - '/admin/'
    condition: selection
falsepositives:
    - Legitimate administrative access from authorized users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-38945 Multilaser Router Access Control Bypass Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/cgi-bin/admin.cgi"; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2023-38945;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Place the router behind a firewall that restricts access to the management interface to only trusted IPs.
2. Disable Remote Management: If not required, turn off WAN-side administration.
3. Change Default Credentials: Even though the vulnerability bypasses authentication, changing the password can prevent secondary attacks.

Short-Term Mitigation:

• Reverse Proxy: Deploy a reverse proxy (e.g., Nginx, HAProxy) that requires HTTP Basic Authentication before forwarding traffic to the router.
• Network Segmentation: Place the router in a separate VLAN with strict ACLs.

Long-Term Remediation:

• Vendor Patch: Monitor Multilaser's support site for a firmware update. If none is released, consider the device end-of-life.
• Device Replacement: Replace the vulnerable router with a model from a vendor with a strong security track record and active support.
• Third-Party Firmware: If available, flash the device with an open-source firmware like OpenWrt or DD-WRT (ensure it supports the hardware).

Detection & Monitoring:

• Implement the provided YARA, Sigma, and Suricata rules in your SIEM and NIDS.
• Enable logging on the router (if possible) and forward logs to a central syslog server.
• Conduct regular vulnerability scans to identify exposed devices.

Valters IT
DevSecOps & Cyber Threat Intelligence Division