Huawei eSpace IAD Remote Information Disclosure Vulnerability

[ak47464659484@xxxxxxxxx]

Title: Huawei eSpace IAD Remote Information Disclosure Vulnerability
Software : eSpace IAD

Software Version : 
    Equipment type   : eSpace IAD208E(M)
    PCB      version : AG21CSPG VER.A
    Product  name    : TS0801 and TS0802
    Program  version : V300R001C07SPC800
    BIOS     version : 1035
    Slic     version : 000
    CPLD     version : (U16)101
    DSP      version : VoIP V100R003C01

Vendor: www.huawei.com

Vulnerability Published : 2016-07-30

Author：zhiwei_jiang 
Email:ak47464659484@xxxxxxxxx
Impact :
CVSS Severity (version 2.0):
CVSS v2 Base Score: 5.0 MEDIUM
Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information

Bug Description :
The  eSpace IAD Series Access Devices
Migrating to IP telephony? Huawei?s eSpace Integrated Access Device (IAD) 
Series lets you support existing analog equipment to extend the useful life of 
legacy phones and fax machines. Available in a compact desktop model for a 
small office with 4 devices, or a 2U rack-mount system with up to 224 ports, 
providing Foreign eXchange Subscriber (FXS) interfaces.
Reliability features including triple homing, power-off survival, and network 
outage survival ? with multiple QoS mechanisms ? ensure high-availability, as 
well as high-quality voice services.
Integrates seamlessly with Huawei IP telephony and multimedia communications 
solutions.

eSpace IAD  (ver Equipment type   : eSpace IAD208E(M) Product  name    : TS0801 
and TS0802 Program  version : V300R001C07SPC800 ) an authorization check when 
an actor attempts to access a resource or perform an action, but it does not 
correctly perform the check. This allows attackers to bypass intended access 
restrictions,Download sensitive data. 

PoC:
http://x.x.x.x/goform/downloadIadInfomation


Solution :


For web applications, make sure that the access control mechanism is enforced 
correctly at the server side on every page. Users should not be able to access 
any unauthorized functionality or information by simply requesting direct 
access to that page.

One way to do this is to ensure that all pages containing sensitive information 
are not cached, and that all such pages restrict access to requests that are 
accompanied by an active and authenticated session token associated with a user 
who has the required permissions to access that page.