Authentication bypass in routers

An authentication bypass vulnerability is one of the more dangerous problems that a web application can have. It allows the attacker to perform some action that the application designer saw fit to restrict to authenticated users without providing said authentication. Using these techniques, an attacker can control a targeted web application from afar without even wasting time cracking bad passwords—a dream scenario for such people.

If an authentication bypass is found in the latest social networking site, the flaw could cause embarrassment, but if that bypass is in your home router, much worse things could result. A series of articles over at GNUCITIZEN highlights quite a variety of authentication bypass flaws in various embedded devices including routers. The flaws come from their research and recent router hacking challenge, which challenged readers to find holes in their routers. (There is no table of contents for the series, so here are links to the four installments: 1, 2, 3, and 4).

Most authentication bypass flaws are caused by a conceptual mistake made by web programmers: believing that the "normal" way of accessing the site is the only way to access it. This manifests itself as applications that check for particular URLs to see if they require credentials without considering the possibility of aliasing. For example, web servers will generally ignore double-slashes in a URL, but if the application checks for /privileged/page and gets /privileged//page it may very well fall prey to an authentication bypass. Other similar schemes can be used to make the URL look different, but arrive at the same place.

A far uglier possibility is applications that believe you can only get to a particular URL via a page that enforces authentication. This is a belief in "security through obscurity"; that attackers won't be able to guess the URLs for the pages "behind" the authentication screen. This is almost comical in that there are many ways to find out what those URLs are, not least by buying the device and accessing them yourself. Pages that require authentication need to check that the credentials have been provided whenever the page is accessed—without regard for what URL got them there.

Some applications do all of the checking correctly on the pages that show various settings in a form allowing them to be changed, but the action of the form submits it to a different program. Inexplicably, sometimes that program does not check for credentials. Perhaps the programmer believes that web forms can only be submitted from the page that they have created, but it is trivially easy to generate an HTTP POST with the appropriate parameters. It certainly does no good to protect the current value of settings from non-authenticated users if they can easily change them to any values they want.

In terms of web security, authentication bypass is usually quite easy to avoid, it is a matter of ensuring valid credentials anywhere they are required. Before performing any action that requires a logged-in user, check the cookie (or other persistent authentication mechanism) for validity to perform the action requested. For people using routers at home, perhaps the best advice is to make sure its administrative interface is not internet facing. Routers have a pretty bad track record of getting this right, so far, as the hacking challenge and other research has shown.