How to remediate – UPnP Internet Gateway Device (IGD) Port Mapping Listing

1. Introduction

The UPnP Internet Gateway Device (IGD) Port Mapping Listing vulnerability allows an attacker to view port mappings created via UPnP on a remote device. This can expose internal services and create security holes in the firewall. NAT routers supporting the IGD standard are typically affected, potentially impacting confidentiality, integrity, and availability of systems behind the router.

2. Technical Explanation

The vulnerability occurs because devices incorrectly list port mappings created through the UPnP IGD protocol. This allows remote attackers to discover open ports forwarded into the network. An unauthenticated attacker can exploit this via JavaScript or a malicious Flash animation. Adjacent attackers have unrestricted access to the interface.

• Root cause: The device exposes port mapping information without authentication.
• Exploit mechanism: An attacker sends requests to the IGD service to list active port mappings, revealing internal network details. For example, a JavaScript script embedded in a webpage could query the IGD and report the findings back to an attacker’s server.
• Scope: NAT routers supporting the Internet Gateway Device (IGD) standard are affected.

3. Detection and Assessment

You can confirm vulnerability by checking for the presence of UPnP mappings or scanning with a tool that identifies open ports forwarded via UPnP.

• Quick checks: Check your router’s web interface for UPnP settings and enabled port forwarding rules.
• Scanning: Nessus plugin ID 10853 can identify this vulnerability. Other scanners may have similar capabilities, but results should be verified.
• Logs and evidence: Router logs might show UPnP requests if logging is enabled. Look for events related to IGD or port mapping creation.

nmap --script upnp-info 

4. Solution / Remediation Steps

Disable the Internet Gateway Device (IGD) feature on your router, or restrict access to trusted networks only.

4.1 Preparation

• The roll back plan is to re-enable IGD if the change causes connectivity issues.
• A change window may be needed depending on network usage and criticality of forwarded ports. Approval from a senior IT administrator might be necessary.

4.2 Implementation

1. Step 1: Log in to your router’s web interface.
2. Step 2: Navigate to the UPnP settings page (usually found under Advanced Settings, Security, or Firewall).
3. Step 3: Disable the UPnP feature entirely. If disabling is not possible, restrict access to trusted IP addresses only.
4. Step 4: Save your changes and reboot the router if prompted.

4.3 Config or Code Example

Before

UPnP: Enabled

After

UPnP: Disabled

4.4 Security Practices Relevant to This Vulnerability

Practices like least privilege and secure defaults can help prevent this issue. Least privilege limits the impact if UPnP is exploited, while disabling unnecessary features reduces the attack surface.

• Practice 1: Least privilege – only allow necessary services access to external networks.
• Practice 2: Secure Defaults – disable unused features like UPnP by default.

4.5 Automation (Optional)

Automation is unlikely to be suitable for this vulnerability due to the variety of router interfaces.

5. Verification / Validation

Confirm the fix by checking that port mappings are no longer listed via UPnP and re-running your initial detection method.

• Post-fix check: Run `nmap –script upnp-info ` again; it should report no open ports or a connection refused error.
• Re-test: Re-run the Nessus scan (ID 10853); it should no longer detect the vulnerability.
• Monitoring: Monitor router logs for unexpected UPnP requests, though this is unlikely to be effective if UPnP is fully disabled.

nmap --script upnp-info  -p 5000

6. Preventive Measures and Monitoring

Update security baselines to include disabling UPnP by default, and consider adding checks in your deployment pipelines to ensure it remains disabled on new routers.

• Baselines: Update your router configuration baseline to disable UPnP.
• Pipelines: Include a check during router provisioning or configuration management to verify UPnP is disabled.
• Asset and patch process: Review router firmware updates regularly, as they may address UPnP vulnerabilities.

7. Risks, Side Effects, and Roll Back

Disabling UPnP might break functionality that relies on automatic port forwarding, such as some online games or remote access applications. The roll back steps are to re-enable UPnP in your router’s web interface.

• Risk or side effect 1: Disabling UPnP may require manual configuration of port forwarding rules for affected services.
• Roll back: 1) Log in to your router’s web interface. 2) Navigate to the UPnP settings page. 3) Re-enable the UPnP feature and save your changes.

8. References and Resources

• Vendor advisory or bulletin: Check your router manufacturer’s website for specific security advisories related to UPnP.
• NVD or CVE entry: https://nvd.nist.gov/vuln/detail/CVE-2018-1336
• Product or platform documentation relevant to the fix: Refer to your router’s user manual for instructions on disabling UPnP.