D-Link DAP-1360 Vulnerabilities

34   2019-08-05 08:08   nipc
漏洞信息
漏洞编号: 1328
CVE编号:
漏洞类型: -
漏洞来源: cxs
发布日期: 2014-11-05
CVSS
CVSS值: -
严重级别: 低危
利用范围: -
攻击复杂度: -
认证级别: -
漏洞描述

WLB-2014110019[***]http://cxsecurity.com/issue/WLB-2014110019[***]Bug: D-Link DAP-1360 Vulnerabilities ( Ascii Version )[***]D-Link DAP-1360 Vulnerabilities[***]2014.11.05[***]MustLive[***]Low[***]N/A [***]N/A ( Add )@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** </form>[***]No[***]Yes[***][***][***][***][***][***][***][***][***] Hello list!@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** vulnerabilities in D-Link DAP-1360 (Wi-Fi Access Point and Router).@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** -------------------------@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Affected products:@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** -------------------------@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** with other firmware versions also must be vulnerable.@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** D-Link will fix these vulnerabilities in the next version of firmware (will@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** be released in November), as they answered me in October. Except minor@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** vulnerability - Abuse of Functionality.@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** ----------@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Details:@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** ----------@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Abuse of Functionality (WASC-42):@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Login is persistent: admin. Which simplify Brute Force attack.@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Brute Force (WASC-11):@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** In login form http://192.168.0.50 there is no protection against Brute Force@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** attacks. Which allows to pick up password (if it was changed from default),@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** particularly at local attack. E.g. via LAN malicious users or virus at some@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** computer can conduct attack for picking up the password, if it was changed.@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** For attacks it's needed to send POST request with cookie with login and@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** password:@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Cookie: cookie_lang=ukr; client_login=admin; client_password=1@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Cross-Site Request Forgery (WASC-09):@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Lack of protection against Brute Force (such as captcha) also leads to@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** possibility of conducting of CSRF attacks, which I wrote about in the@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** article Attacks on unprotected login forms@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** (http://lists.webappsec.org/pipermail/websecu

POC

Hello list! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 (Wi-Fi Access Point and Router). ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other firmware versions also must be vulnerable. D-Link will fix these vulnerabilities in the next version of firmware (will be released in November), as they answered me in October. Except minor vulnerability - Abuse of Functionality. ---------- Details: ---------- Abuse of Functionality (WASC-42): Login is persistent: admin. Which simplify Brute Force attack. Brute Force (WASC-11): In login form http://192.168.0.50 there is no protection against Brute Force attacks. Which allows to pick up password (if it was changed from default), particularly at local attack. E.g. via LAN malicious users or virus at some computer can conduct attack for picking up the password, if it was changed. For attacks it's needed to send POST request with cookie with login and password: Cookie: cookie_lang=ukr; client_login=admin; client_password=1 Cross-Site Request Forgery (WASC-09): Lack of protection against Brute Force (such as captcha) also leads to possibility of conducting of CSRF attacks, which I wrote about in the article Attacks on unprotected login forms (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html). It allows to conduct remote login. Which will be in handy at conducting of attacks on different CSRF and XSS vulnerabilities in control panel. For attacks it's needed to send POST request with cookie with login and password (e.g. it can be set using Flash or other plugins): Cookie: cookie_lang=ukr; client_login=admin; client_password=1 There are many CSRF vulnerabilities inside admin panel and I'll write about them in the next advisory ------------ Timeline: ------------ 2014.05.08 - announced at my site. 2014.05.22 - informed developer about multiple vulnerabilities. 2014.07.12 - disclosed at my site (http://websecurity.com.ua/7168/). Best wishes &amp; regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua