D-Link DIR-300NRUB5 Firmware 1.2.94 Cross Site Request Forgery
2016-10-31T00:00:00
ID PACKETSTORM:139436 Type packetstorm Reporter MustLive Modified 2016-10-31T00:00:00
Description
`Hello list!
There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery
vulnerabilities in D-Link DIR-300.
-------------------------
Affected products:
-------------------------
Vulnerable is the next model: D-Link DIR-300NRUB5, Firmware 1.2.94. All
previous versions also must be vulnerable.
----------
Details:
----------
Abuse of Functionality (WASC-42):
Admin's login is persistent: admin. Which simplify BF and CSRF attacks.
Brute Force (WASC-11):
http://site
No protection from BF attacks. If there is no Path Traversal vulnerability
in this device to get admin's password, then it's possible to pick it up.
Even I found DIR-300 with firmware version from 2009, where there was a
captcha (that can be turned on/off in the settings), but there was no
captcha in new firmware.
Cross-Site Request Forgery (WASC-09):
Change admin's password:
http://site/index.cgi?v2=y&rq=y&res_config_action=3&res_config_id=69&res_struct_size=1&res_buf=password|
------------
Timeline:
------------
2015.04.24 - announced at my site about vulnerabilities in DIR-300.
2015-2016 - informed developers about multiple vulnerabilities in this and
other D-Link devices.
2016.08.27 - disclosed at my site (http://websecurity.com.ua/7722/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
`
{"id": "PACKETSTORM:139436", "type": "packetstorm", "bulletinFamily": "exploit", "title": "D-Link DIR-300NRUB5 Firmware 1.2.94 Cross Site Request Forgery", "description": "", "published": "2016-10-31T00:00:00", "modified": "2016-10-31T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://packetstormsecurity.com/files/139436/D-Link-DIR-300NRUB5-Firmware-1.2.94-Cross-Site-Request-Forgery.html", "reporter": "MustLive", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:20:09", "viewCount": 32, "enchantments": {"score": {"value": 1.1, "vector": "NONE", "modified": "2016-11-03T10:20:09", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:20:09", "rev": 2}, "vulnersScore": 1.1}, "sourceHref": "https://packetstormsecurity.com/files/download/139436/dlinkdir3001294-xsrf.txt", "sourceData": "`Hello list! \n \nThere are Abuse of Functionality, Brute Force and Cross-Site Request Forgery \nvulnerabilities in D-Link DIR-300. \n \n------------------------- \nAffected products: \n------------------------- \n \nVulnerable is the next model: D-Link DIR-300NRUB5, Firmware 1.2.94. All \nprevious versions also must be vulnerable. \n \n---------- \nDetails: \n---------- \n \nAbuse of Functionality (WASC-42): \n \nAdmin's login is persistent: admin. Which simplify BF and CSRF attacks. \n \nBrute Force (WASC-11): \n \nhttp://site \n \nNo protection from BF attacks. If there is no Path Traversal vulnerability \nin this device to get admin's password, then it's possible to pick it up. \n \nEven I found DIR-300 with firmware version from 2009, where there was a \ncaptcha (that can be turned on/off in the settings), but there was no \ncaptcha in new firmware. \n \nCross-Site Request Forgery (WASC-09): \n \nChange admin's password: \n \nhttp://site/index.cgi?v2=y&rq=y&res_config_action=3&res_config_id=69&res_struct_size=1&res_buf=password| \n \n------------ \nTimeline: \n------------ \n \n2015.04.24 - announced at my site about vulnerabilities in DIR-300. \n2015-2016 - informed developers about multiple vulnerabilities in this and \nother D-Link devices. \n2016.08.27 - disclosed at my site (http://websecurity.com.ua/7722/). \n \nBest wishes & regards, \nMustLive \nAdministrator of Websecurity web site \nhttp://websecurity.com.ua \n`\n", "immutableFields": []}