LLegoLLaS Posted September 22, 2011 Report Share Posted September 22, 2011 Sense of Security - Security Advisory - SOS-11-011Release Date. 20-Sep-2011Last Update. -Vendor Notification Date. 22-Mar-2011Product. NETGEAR Wireless Cable Modem GatewayCG814WGAffected versions. Hardware 1.03,Software V3.9.26 R14 verified,possibly othersSeverity Rating. HighImpact. Authentication bypass,Cross Site Request ForgeryAttack Vector. Remote without authenticationSolution Status. Upgrade to R15 (by contacting NETGEAR)CVE reference. Not yet assignedDetails.The NETGEAR Wireless Cable Modem Gateway CG814WG is supplied by ISP'sas customer premises equipment within Australia and abroad. It is acentrally managed ISP solution whereby each ISP's devices run acustomised firmware and configuration changes and updates can be pushedout as required.Basic authentication is used as the primary and only authenticationmechanism for the administrator interface on the device. The basicauthentication can be bypassed by sending a valid POST request to thedevice without sending any authentication header. The response from thedevice sends the user to another page that requests basicauthentication, however at this point the request has already beenprocessed.An example of attacks using the basic authentication bypass may includechanging the admin password or enabling the remote admin interface(Internet facing).Additionally, due to the lack of CSRF protection in the web application,the bypass attack can be coupled with CSRF to have a victim enable theremote admin interface to the Internet, where an attacker can then usethe bypass attack again across the remote admin interface to reset theadmin password and access the device. This attack is possible whentargeting a victim that is behind the NETGEAR device on the same segmentas the web administrator interface whom has browsed to a malicious sitecontaining the CSRF attack.NETGEAR was notified of this vulnerability on 22 March 2011, but wenever received a response or acknowledgement of the issue or fix. Senseof Security notified local ISP's and it was escalated by a local ISPwho worked with NETGEAR to develop and test an update. Sense of Securitywas never provided an opportunity to validate the fixes in the latestfirmware version. Given the severity of the issue it would be prudentfor NETGEAR to notify and supply an update to all of its customers.Proof of Concept.By embedding the below HTML in a website and having avictim browse to the website the remote management interface to theInternet would be enabled. An attacker could then use one of thehardcoded passwords for the device to access it, or use a basicauthentication bypass to change the admin password. Alternatively, theattacker could conduct a CSRF attack that implements two POST requeststo have the remote admin interface enabled, and the admin passwordchanged.The example here is a basic proof of concept, more complex exampleswhich include JavaScript redirects to mask the basic authenticationpop-up would be more stealthy. <html><head></head><body onLoad=javascript:document.form.submit()><form action="http://192.168.0.1/goform/RgRemoteManagement"method="POST" name="form"><input type="hidden" name="NetgearRmEnable" value="0x01"><input type="hidden" name="NetgearRmPortNumber" value="1337"><input type="hidden" name="NetgearUserLevel" value="1"></form></body></html>SolutionAsk your ISP to obtain the latest firmware from NETGEAR and deploy itto your device.Discovered bySense of Security Labs.sursa: http://www.bugsearch.net/en/12338/netgear-wireless-cable-modem-gateway-auth-bypass-and-csrf.html?ref=2 Quote Link to comment Share on other sites More sharing options...
co4ie Posted September 23, 2011 Report Share Posted September 23, 2011 e bine ... vulnerabilitatea asta va ramane mult si bine!! Merci mult ! Quote Link to comment Share on other sites More sharing options...
