CVE-2024-4021

Executive Summary

CVE-2024-4021 is a problematic information disclosure vulnerability affecting multiple Keenetic router models (KN-1010, KN-1410, KN-1711, KN-1810, KN-1910) running firmware version 4.1.2.15 or earlier. The flaw resides in the /ndmComponents.js file, which is part of the device's Configuration Setting Handler. An unauthenticated, remote attacker can exploit this to leak sensitive configuration data, potentially exposing network topology, credentials, or other internal settings. The vulnerability has a CVSS score of 5.3 (Medium) and a public PoC exists. The vendor has acknowledged the issue but has not yet released a patch, with a planned fix by the end of 2024.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded devices (Keenetic routers). No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited information disclosure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The attack is trivial to execute, but the information disclosed is limited. However, leaked configuration data can aid further attacks.

Deep Dive & Mechanics

The vulnerability is an information disclosure flaw in the /ndmComponents.js JavaScript file served by the Keenetic router's web interface. This file is part of the device's configuration handler and is intended to be used by the web UI to manage settings. However, due to improper access controls, the file is accessible without authentication.

Mechanism:

1. An attacker sends a GET request to http://<router-ip>/ndmComponents.js.
2. The server returns the file contents, which may include sensitive configuration parameters such as:
   • Wi-Fi SSIDs and passwords (if stored in plaintext or obfuscated).
   • Admin credentials or session tokens.
   • Network topology details (DHCP leases, DNS settings).
   • Firmware version and build information.
3. The attacker can parse the JavaScript to extract these values.

Root Cause: The web server does not enforce authentication for static resource files under the /ndmComponents.js path. This is a classic case of missing authorization for a sensitive endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (firmware <= 4.1.2.15): The /ndmComponents.js file is served without any authentication check. Example snippet (hypothetical):

// ndmComponents.js - vulnerable version
var config = {
    adminPassword: "admin123",
    wifiSSID: "MyNetwork",
    wifiKey: "secret123",
    dhcpRange: "192.168.1.100-200"
};

Patched Code (expected in future firmware): The patched version should include an authentication check before serving the file. Example:

// ndmComponents.js - patched version (hypothetical)
if (!isAuthenticated()) {
    return 403 Forbidden;
}
var config = {
    adminPassword: "***",
    wifiSSID: "MyNetwork",
    wifiKey: "***",
    dhcpRange: "192.168.1.100-200"
};

The vendor has not yet released a patch, so no official patched code is available.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Keenetic router (KN-1010, KN-1410, KN-1711, KN-1810, or KN-1910) with firmware <= 4.1.2.15.
• Network access to the router's web interface (port 80 or 443).

Exploitation Steps:

1. Identify the target router's IP address (e.g., via Shodan or local network scan).
2. Send a GET request to the vulnerable endpoint:

   curl http://<target-ip>/ndmComponents.js
   

3. Analyze the response. Look for sensitive strings like password, key, token, admin, etc.
4. Use the extracted information for further attacks (e.g., login to the admin panel, pivot to internal network).

Example Output:

// Response from vulnerable router
var ndmConfig = {
    "admin": {
        "username": "admin",
        "password": "plaintext_password"
    },
    "wifi": {
        "ssid": "HomeNetwork",
        "key": "wifi_secret"
    }
};

Blue Team

Detection:

• Monitor for HTTP GET requests to /ndmComponents.js from external IPs.
• Alert on any access to this file without a valid session cookie.
• Use the Sigma rule below to detect exploitation attempts.

Honeypot:

• Deploy a fake Keenetic router endpoint that returns a decoy /ndmComponents.js file. Log all access attempts.

Mitigation:

• Block external access to the router's web interface (use VPN or firewall rules).
• Apply vendor patch when available.
• Change default credentials and use strong passwords.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /ndmComponents.js from suspicious IPs.
  • User-Agent strings commonly used by scanning tools (e.g., curl, python-requests, Go-http-client).
• File IOCs:
  • Presence of /ndmComponents.js file on the router (legitimate but should not be accessible without auth).
• Behavioral IOCs:
  • Unauthorized access to router configuration pages.
  • Sudden changes to Wi-Fi settings or admin credentials.

Detection Engineering

YARA Rule

rule CVE_2024_4021_Keenetic_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2024-4021 by looking for requests to /ndmComponents.js"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4021"
    strings:
        $s1 = "/ndmComponents.js" ascii wide nocase
    condition:
        $s1
}

Sigma Rule

title: Keenetic Router Information Disclosure via /ndmComponents.js
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP GET requests to the vulnerable /ndmComponents.js endpoint on Keenetic routers.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4021
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/ndmComponents.js'
    condition: selection
falsepositives:
    - Legitimate admin access from internal network
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4021 Keenetic Router Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/ndmComponents.js"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Block external access to the router's web interface (port 80/443) from the internet. Use a VPN for remote management.
2. Change Default Credentials: Ensure admin passwords are strong and unique.
3. Monitor Logs: Check router logs for unauthorized access attempts to /ndmComponents.js.

Long-Term Fix:

• Apply the vendor's firmware update when released (expected by end of 2024).
• If no patch is available, consider replacing the router with a more secure model.

Workaround:

• Use a reverse proxy or firewall rule to block requests to /ndmComponents.js from untrusted networks.

Valters IT