A security has discovered a serious flaw in the operating system that allows attackers to inject malware into vulnerable systems.
OpenWrt is a Linux- used primarily in embedded devices and routers for routing network traffic and is present in millions of devices around the world.
The flaw, which has been dubbed an RCE, allows the package manager to ignore the SHA-256 checksum, allowing an attacker to bypass the checking of .ipk packages. Researcher Guido Vranken explained that he found the vulnerability by accident while preparing a task for opkg.
To exploit the flaw, one must first send the infected packets from a web server. Then, communication must be established between the device and downloads.openwrt.org, and the attacker must be able to change the DNS Server so that downloads.openwrt.org points to a server that is under the attacker's control. In effect, the OpenWrt opkg allows attackers to gain full access to the entire system.
During the attack, the hacker must have a valid and signed package index from downloads.openwrt.org, while the malicious packages must have the same size as the one listed in the index.
The vulnerability has now been fixed and users are advised to upgrade system to the latest version of OpenWrt. The upgrade is done with the following commands:
cd /tmp
opkg update
opkg download opkg
zcat ./opkg-lists/openwrt_base | grep -A10 "Package: opkg" | grep SHA256sum
sha256sum ./opkg_2020-01-25-c09fe209-1_*.ipk
