D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Route Authentication Bypass

vendor:

DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router

by:

Gem George

9.8

CVSS

CRITICAL

Authentication Bypass

287

CWE

Product Name: DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router

Affected Version From: 1.02

Affected Version To: 2.06

Patch Exists: YES

Related CWE: CVE-2018-9032

CPE: h:d-link:dir-850l_wireless_ac1200_dual_band_gigabit_cloud_router

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Route Authentication Bypass

An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router potentially allows attackers to bypass SharePort Web Access Portal by directly accessing authenticated pages such as /category_view.php or /folder_view.php. This could potentially allow unauthorized remote access of media stored in SharePort and may perform write operation in the portal.

Mitigation:

Ensure that authentication is properly enforced for all web pages.

Source

Exploit-DB raw data:

# Exploit Title: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Route Authentication Bypass
# CVE: CVE-2018-9032
# Date: 24-03-2018
# Exploit Author: Gem George
# Author Contact: https://www.linkedin.com/in/gemgrge
# Vulnerable Product: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router http://www.dlink.co.in/products/?pid=628
# Firmware version: 1.02-2.06
# Hardware version: A1, B1
# Vendor Homepage: https://dlink.com


Vulnerability Details
======================
An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router potentially allows attackers to bypass SharePort Web Access Portal by directly accessing authenticated pages such as /category_view.php or /folder_view.php. This could potentially allow unauthorized remote access of media stored in SharePort and may perform write operation in the portal

How to exploit
===================
Directly call authenticated URLs to bypass authentication

Examples:
* http://[router_ip][port]/category_view.php
* http://[router_ip][port]/folder_view.php

POC
=========
* https://youtu.be/Wmm4p8znS3s