^{CVE-2017-14699:}XML External Entity (XXE) vulnerabilities in ASUS DSL router AiCloud feature allow authenticated users to read arbitrary files.

Overview

The XXE vulnerabilities in ASUS DSL routers' AiCloud feature present a significant security risk as they allow authenticated attackers to access files that should be restricted. When exploited, an attacker can craft special XML requests containing malicious DTD definitions that instruct the XML parser to access local files on the router's file system. This can lead to the disclosure of sensitive configuration files, credentials, or other critical information stored on the device.

The vulnerability specifically affects the processing of XML data in two different request types:

1. UPDATEACCOUNT requests in the AiCloud feature
2. PROPFIND requests in the AiCloud feature

Both vulnerabilities require authentication to exploit, which somewhat limits the attack surface, but still represents a serious security concern for deployed devices.

Remediation

To address these vulnerabilities, users should take the following actions:

1. Update router firmware immediately to the latest version provided by ASUS. The manufacturer has released patches to address these vulnerabilities.

2. Visit the ASUS support website (specifically the HelpDesk_BIOS section for your router model) to download and install the latest firmware.

3. If updates are not immediately available for your specific model, consider implementing these temporary mitigations:

   • Disable the AiCloud feature if not actively used
   • Ensure strong authentication credentials are set for router access
   • Limit administrative access to trusted IP addresses only
   • Monitor router logs for suspicious activities

4. After updating, verify that the update was successful by checking the current firmware version in the router's administration interface.

References

1. ASUS DSL-N14U-B1 firmware updates and advisories: https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/

2. Security Artwork vulnerability analysis (Note: This link may no longer be active): https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/

3. CWE-611: Improper Restriction of XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html

4. ASUS Support Center for checking firmware updates for all affected models: https://www.asus.com/support/