lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <009b01cff879$9d5cce30$9b7a6fd5@pc>
Date: Tue, 4 Nov 2014 23:52:03 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>,
	<fulldisclosure@...lists.org>
Subject: [FD] Vulnerabilities in D-Link DAP-1360

Hello list!

There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery
vulnerabilities in D-Link DAP-1360 (Wi-Fi Access Point and Router).

-------------------------
Affected products:
-------------------------

Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model
with other firmware versions also must be vulnerable.

D-Link will fix these vulnerabilities in the next version of firmware (will
be released in November), as they answered me in October. Except minor
vulnerability - Abuse of Functionality.

----------
Details:
----------

Abuse of Functionality (WASC-42):

Login is persistent: admin. Which simplify Brute Force attack.

Brute Force (WASC-11):

In login form http://192.168.0.50 there is no protection against Brute Force
attacks. Which allows to pick up password (if it was changed from default),
particularly at local attack. E.g. via LAN malicious users or virus at some
computer can conduct attack for picking up the password, if it was changed.

For attacks it's needed to send POST request with cookie with login and
password:

Cookie: cookie_lang=ukr; client_login=admin; client_password=1

Cross-Site Request Forgery (WASC-09):

Lack of protection against Brute Force (such as captcha) also leads to
possibility of conducting of CSRF attacks, which I wrote about in the
article Attacks on unprotected login forms
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html).
It allows to conduct remote login. Which will be in handy at conducting of
attacks on different CSRF and XSS vulnerabilities in control panel.

For attacks it's needed to send POST request with cookie with login and
password (e.g. it can be set using Flash or other plugins):

Cookie: cookie_lang=ukr; client_login=admin; client_password=1

There are many CSRF vulnerabilities inside admin panel and I'll write about
them in the next advisory

------------
Timeline:
------------ 

2014.05.08 - announced at my site.
2014.05.22 - informed developer about multiple vulnerabilities.
2014.07.12 - disclosed at my site (http://websecurity.com.ua/7168/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ