CommScope Ruckus IoT Controller Hard-coded Web Application Administrator Password

Vulnerability Description

An undocumented, administrative-level, hard coded web application account exists in the IoT Controller OVA which cannot be changed by the customer.

Technical Description

Ruckus vRIoT server software is available from the software library at: https://support.ruckuswireless.com/software/

Once the OVA is imported into VirtualBox, a VMDK file is created. The VMDK file can be mounted and the directory structure and its contents can be perused. The virtual appliance contains two web application accounts with passwords stored in clear text on the file system. The two accounts are admin and nplus1user. The admin account is documented in vendor documentation, but the nplus1user account is undocumented.

The password for admin is documented and can be changed by the user. The password for the nplus1user account is nplus1user. Both accounts are administrative-level accounts. The virtual appliance does not appear to offer a mechanism for changing the default password from the vendor for the nplus1user account.

Mitigation and Remediation Recommendation

The vendor has released an updated firmware (1.8.0.0) which remediates the described vulnerability. Firmware and release notes are available at:

https://www.commscope.com/globalassets/digizuite/917216-faq-security-advisory-id-20210525-v1-0.pdf

Credit

This vulnerability was discovered by Jim Becher (@jimbecher) of KoreLogic, Inc.

Proof of Concept

With the VMDK file mounted at the current working directory:

$ more ./VRIOT/authServer/app/authapi# more __init__.py
...
    try:
        if not Account.objects.count()>0:
            admin_acc = Account()
            admin_acc.username = 'admin'
            admin_acc.first_name = 'Ed'
            admin_acc.last_name = 'Sy'
            admin_acc.company = 'Ruckus'
            admin_acc.email = 'admin@ruckuswireless.com'
            admin_acc.password = pbkdf2_sha256.hash('admin')
            admin_acc.send_notification = False
            admin_acc.save()
            with open('/var/log/auth_mongo_conn.log','a+') as f:
                f.write('Admin Account Created Succssfully!')

        admin_acc = Account()
        admin_acc.username = 'nplus1user'
        admin_acc.first_name = 'Ed'
        admin_acc.last_name = 'Sy'
        admin_acc.company = 'Ruckus'
        admin_acc.email = 'nplus1user@ruckuswireless.com'
        admin_acc.password = pbkdf2_sha256.hash('nplus1user')
...

The contents of this advisory are copyright(c) 2021 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.3.txt