CVE-2019-11367
📋 TL;DR
This vulnerability allows unauthenticated attackers to bypass authentication on AUO Solar Data Recorder web portals by extracting credentials from WWW-Authenticate headers. Anyone with network access to vulnerable systems can gain administrative access. Affects AUO Solar Data Recorder installations before version 1.3.0.
💻 Affected Systems
- AUO Solar Data Recorder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to manipulate solar monitoring data, disrupt energy operations, or pivot to other network systems.
Likely Case
Unauthorized access to solar monitoring dashboards, data theft, and potential manipulation of energy production records.
If Mitigated
Limited to attempted authentication failures if proper network segmentation and monitoring are in place.
🎯 Exploit Status
Simple HTTP request/response analysis reveals credentials. Multiple public proof-of-concept scripts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.0
Vendor Advisory: Not publicly documented
Restart Required: Yes
Instructions:
1. Contact AUO for version 1.3.0 update
2. Backup current configuration
3. Apply firmware update
4. Restart system
5. Verify authentication now requires proper credentials
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to web portal using firewall rules
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Reverse Proxy with Authentication
allPlace vulnerable system behind reverse proxy requiring proper authentication
# Configure nginx/apache as reverse proxy with strong auth
🧯 If You Can't Patch
- Isolate system on separate VLAN with strict firewall rules
- Implement network monitoring for authentication attempts and block suspicious IPs
🔍 How to Verify
Check if Vulnerable:
Send HTTP request to web portal and check if WWW-Authenticate header contains credentials: curl -I http://target-ip/Check Version:
Check web interface footer or contact vendor - no standard command availableVerify Fix Applied:
Attempt to access web portal without credentials should return 401 without exposing credentials in headers📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from unusual IPs
- Authentication attempts without proper user-agent
Network Indicators:
- HTTP requests to / with Authorization headers
- Unusual traffic patterns to solar monitoring ports
SIEM Query:
source="web_logs" AND (status=200 AND auth_method="Basic" AND user_agent="curl" OR status=401 AND response_headers="*WWW-Authenticate: Basic realm=*password*"))🔗 References
- http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html
- https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view
- https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367
- http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html
- https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view
- https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367
