Security Issue -- GRAX66 / AX6600-E / AXE6600 -- IPv6 Security Vulnerability -- SSH open to Internet on IPv6 -- Firewall broken for IPv6

A

anthony.metzidi153b02d0

Member
Joined
Nov 26, 2023
Messages
32
Seems like IPv6 security configuration is broken on GRAX66 . SSH is listening and available to internet on IPv6, despite "LAN-ONLY" setting.

There are other serious IPv6 Issues:
  • * DNS/ port-53 is open to internet . this is a big risk since port-53 is unauthenticated.
  • * Firewall does not support IPv6 configuration. There's no way to block IPv6 traffic on the router settings.

STEPS to REPRODUCE
1. enable IPv6 + ssh ( LAN-only ) setting
2. connect to SSH from internet

ACTUAL RESULTS
1. ssh connection works (this is bad)

EXPECTED RESULTS
1. ssh connection should fail

Example Config
See Advanced ➡Administration ➡System Management
1701627300875.png

TEST SSH FROM INTERNET
Bash: 
ssh ubnt@$addr
ubnt@xxxxx: Permission denied (publickey).
PORT SCAN FROM INTERNET
Bash: 
nmap -6 xxxxx
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-03 10:13 PST
Nmap scan report for xxxxxx
Host is up (0.019s latency).
Not shown: 993 closed tcp ports (conn-refused)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1080/tcp filtered socks

Firewall Configuration shows SSH listening on IPV6 ALL Interfaces
Preferred configuration should listen only on LAN interface
Bash: 
 netstat -l |grep 22
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 :::22                   :::*                    LISTEN
udp        0      0 :::49622                :::*

Device Information
Hardware = MSI AX6600-E / GRAX66
Firmware: 692763
 
Last edited:
Sort by date Sort by votes
Nichrome said:
Oof that's bad. Passed it down to my contact.
Click to expand...
I confirmed that IPv6 firewall is broken b/c I can ping & SSH to the br0 address from internet.

Code: 
nmap -6 <br0 address>
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-03 12:30 PST
Nmap scan report for xxxxx
Host is up (0.022s latency).
Not shown: 993 closed tcp ports (conn-refused)
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1080/tcp filtered socks

Code: 
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
➜  ~ ping xxxxx
PINGxxxx 56 data bytes
64 bytes from xxxx icmp_seq=1 ttl=49 time=20.6 ms
 
Upvote 0 Downvote
Yeah that's incredibly bad.
Do you get the same if you run nmap against ipv4? Or does that at least work fine?
 
Upvote 0 Downvote
Nichrome said:
Yeah that's incredibly bad.
Do you get the same if you run nmap against ipv4? Or does that at least work fine?
Click to expand...
IPv4 tests OK against the WAN IP . But I still have some concerns b/c I'm unable to see the firewall configuration (default firewall UI doesn't show the policy).

Bash: 
➜ ping $ipv4
PING $ipv4 ($ipv4) 56(84) bytes of data.
--- $ipv4 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2054ms

➜  ~ telnet $ipv4 22
Trying $ipv4...
➜  ~ nmap -Pn $ipv4
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-04 09:15 PST
 
Upvote 0 Downvote
Hi
MSI was able to duplicate the issue and they're working on a BETA FW fixing this that they aim to release within 1-2 weeks.
 
Upvote 0 Downvote
Thanks for forwarding and keeping me updated . Just to review there are a few areas needing attention

1. IPv6 no default firewall
2. Firewall config doesn’t support ipv6
3. SSH and dns are listening on wan interface
4. OpenSSh and dropbear dns servers both have known CVE

Could you check which ones are receiving attention ?
 
Upvote 0 Downvote
Hi,

Got a reply from my contact.

1 and 2 : AXE6600/AX6600 does not support IPv6 firewall for client device.

3: Please update the following firmware to resolve the problem

SSH IPv6 Listen to WAN Fix - Google Drive

drive.google.com drive.google.com

4. CVE-2021-36369 mainly impact SSH client side. Router is on server side so it has no such issue.
 
Upvote 0 Downvote
Here is an example CVE scan of MSI firmware
1. install namp and the vulners script https://github.com/vulnersCom/nmap-vulners
2. nmap -sV --script vulners 192.168.10.1


Bash: 
nmap -sV --script vulners 192.168.10.1
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-17 15:02 PST
<taskprogress task="SYN Stealth Scan" time="1702854224" percent="45.95" remaining="520" etc="1702854744"/>
<taskprogress task="SYN Stealth Scan" time="1702854269" percent="50.98" remaining="469" etc="1702854737"/>
Nmap scan report for 192.168.10.1
Host is up (0.0049s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
53/tcp open  domain  dnsmasq 2.86
| vulners:
|   cpe:/a:thekelleys:dnsmasq:2.86:
|       PRION:CVE-2021-45957    7.5     https://vulners.com/prion/PRION:CVE-2021-45957
|       PRION:CVE-2021-45956    7.5     https://vulners.com/prion/PRION:CVE-2021-45956
|       PRION:CVE-2021-45955    7.5     https://vulners.com/prion/PRION:CVE-2021-45955
|       PRION:CVE-2021-45954    7.5     https://vulners.com/prion/PRION:CVE-2021-45954
|       PRION:CVE-2021-45953    7.5     https://vulners.com/prion/PRION:CVE-2021-45953
|       PRION:CVE-2021-45952    7.5     https://vulners.com/prion/PRION:CVE-2021-45952
|       PRION:CVE-2021-45951    7.5     https://vulners.com/prion/PRION:CVE-2021-45951
|       CVE-2021-45957  7.5     https://vulners.com/cve/CVE-2021-45957
|       CVE-2021-45956  7.5     https://vulners.com/cve/CVE-2021-45956
|       CVE-2021-45955  7.5     https://vulners.com/cve/CVE-2021-45955
|       CVE-2021-45954  7.5     https://vulners.com/cve/CVE-2021-45954
|       CVE-2021-45953  7.5     https://vulners.com/cve/CVE-2021-45953
|       CVE-2021-45952  7.5     https://vulners.com/cve/CVE-2021-45952
|       CVE-2021-45951  7.5     https://vulners.com/cve/CVE-2021-45951
|       PRION:CVE-2023-28450    5.0     https://vulners.com/prion/PRION:CVE-2023-28450
|       PRION:CVE-2022-0934     5.0     https://vulners.com/prion/PRION:CVE-2022-0934
|       CVE-2022-0934   5.0     https://vulners.com/cve/CVE-2022-0934
|       79068BEF-A572-5A8A-88D0-177524BDAAFE    5.0     https://vulners.com/githubexploit/79068BEF-A572-5A8A-88D0-177524BDAAFE  *EXPLOIT*
|       OSV:OSV-2022-785        0.0     https://vulners.com/osv/OSV:OSV-2022-785
|       OSV:OSV-2022-6  0.0     https://vulners.com/osv/OSV:OSV-2022-6
|       OSV:OSV-2022-324        0.0     https://vulners.com/osv/OSV:OSV-2022-324
|       OSV:OSV-2022-10 0.0     https://vulners.com/osv/OSV:OSV-2022-10
|       OSV:OSV-2021-935        0.0     https://vulners.com/osv/OSV:OSV-2021-935
|       OSV:OSV-2021-933        0.0     https://vulners.com/osv/OSV:OSV-2021-933
|       OSV:OSV-2021-932        0.0     https://vulners.com/osv/OSV:OSV-2021-932
|       OSV:OSV-2021-931        0.0     https://vulners.com/osv/OSV:OSV-2021-931
|       OSV:OSV-2021-929        0.0     https://vulners.com/osv/OSV:OSV-2021-929
|       OSV:OSV-2021-927        0.0     https://vulners.com/osv/OSV:OSV-2021-927
|       OSV:OSV-2021-924        0.0     https://vulners.com/osv/OSV:OSV-2021-924
|_      OSV:OSV-2021-1807       0.0     https://vulners.com/osv/OSV:OSV-2021-1807
 
Upvote 0 Downvote
Nichrome said:
Got a reply from my contact.
Click to expand...
thank you for helping stay on top of this issue I appreciate it.

Nichrome said:
1 and 2 : AXE6600/AX6600 does not support IPv6 firewall for client device.
Click to expand...
This means that GRAX66 Router admin page is available on the internet , even when the "LAN only" option is set. That is a bug.
Nichrome said:
3: Please update the following firmware to resolve the problem

SSH IPv6 Listen to WAN Fix - Google Drive

drive.google.com drive.google.com
Click to expand...
thank you for sharing that I will test it .

Nichrome said:
4. CVE-2021-36369 mainly impact SSH client side. Router is on server side so it has no such issue.
Click to expand...
#4 also mentions CVE-2021-45957 -- affects dnsMasq 2.86 / dropbear . Without IPv6 firewall, that means DNS is accessible from internet with IPv6 enabled. Internet-facing CVE with IPv6 enabled.
 
Upvote 0 Downvote
Back
Top