header-logo
Suggest Exploit
vendor:
MBR Series
by:
Doc_Hak
7.5
CVSS
HIGH
Local File Inclusion
94
CWE
Product Name: MBR Series
Affected Version From: MBR1200
Affected Version To: MBR1400
Patch Exists: N/A
Related CWE: N/A
CPE: h:cradlepoint:mbr_series
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Embedded Linux
2015

Cradlepoint MBR LFI

I found a local file include with root level permissions on cradlepoint routers. So far looks like it works on MBR1400 and MBR1200 routers, though others could be affected. I say it is with root level because it can read /etc/passwd and there is no 'x' indicating the hash is stored in the /etc/shadow file. Therefore the root hash is included in this file. To access the root hash on Cradlepoint MBRs simply: curl http://192.168.1.1/../../../../../../../../../../../../etc/passwd

Mitigation:

Ensure that the web application is not vulnerable to local file inclusion attacks by validating user input and sanitizing it before using it in file operations.
Source

Exploit-DB raw data:

# Exploit Title: Cradlepoint MBR LFI
# Date: 7/7/2015
# Exploit Author: Doc_Hak
# Vendor Homepage: https://cradlepoint.com/
# Version: 1200/1400 (REQUIRED)
# Tested on: Embedded linux

I found a local file include with root level permissions on
cradlepoint routers.  So far looks like it works on MBR1400 and MBR1200
routers, though others could be affected.  I say it is with root level
because it can read /etc/passwd and there is no "x" indicating the hash is
stored in the /etc/shadow file.  Therefore the root hash is included in
this file.

To access the root hash on Cradlepoint MBRs simply:

curl http://192.168.1.1/../../../../../../../../../../../../etc/passwd

Navigation

Suggest Exploit

Services By CQR