Linksys WRT110 Command Injection / CSRF

2013.07.12

Credit: Craig Young

Risk: High

Local: No

Remote: Yes

CVE: CVE-2013-3568

CWE: CWE-352
CWE-78

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Hi list,
I would like to inform you that the latest available Linksys WRT110 firmware is prone to root shell command injection via cross-site request forgery.  This vulnerability is the result of the web interface's failure to sanitize ping targets as well as a lack of csrf tokens.  Linksys/Belkin has responded to my report to say that the vulnerability is mitigated by a 10 minute idle-timeout feature which is available for the admin portal on this device.  It is likely that other devices with similar firmware are prone to this as well.

The command execution will not return output but it is possible to direct output into files which are available upon subsequent HTTP requests.

This issue was assigned as CVE-2013-3568.

Kind Regards,
Craig Young (@CraigTweets)

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Linksys WRT110 Command Injection / CSRF

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.