إرسال #977217: TOTOLINK A3002MU V1.0.0-B20230403.1455 Authorization Bypass

The administrative web interface of the TOTOLINK A3002MU is served by a customized build of the Boa HTTP daemon (bin/boa) which runs as root on TCP port 80 and hosts all 67 configuration handlers inside the binary itself. Unlike other products in the same family this build does not ship cstecgi.cgi; every endpoint is addressed as /boafrm/formXxx and is resolved against a plain array of {char *name; handler_t fn} pairs located at 0x4897BC. A single gate function, sub_40FCFC, decides whether the calling client is authenticated before it invokes the handler stored in the matched table entry. The authentication decision is derived from a global session record held in .bss: the login IP string at unk_491000, a client identifier at unk_491058 and a 64-byte session token at unk_491158. Those globals are zero on every boot and are written exclusively by the login success path (sub_449848), which is reachable only through /boafrm/formLogin. The gate obtains the caller's session token by calling sub_4486C8, which compares the client IP string stored at offset 1229 of the per-request structure against the stored login IP and, only on an exact match, copies the token into a 64-byte stack buffer that was previously cleared with memset. Immediately afterwards the gate accepts the request when the URI contains formLogin, or when the first byte of that stack buffer is zero. Because the buffer is zero for every client whose IP is not the stored login IP, the second condition is satisfied for any client that has never logged in. The check is therefore fail-open: it only ever applies to the one client that is already authenticated, and no credential or cookie is required from anyone else. All 67 handlers are consequently reachable pre-authentication, including WPS configuration, IPv6 setup, QoS and firewall rule management, firmware and configuration upload, the diagnostic command interface and the configuration export, which makes every other finding in this firmware reachable without credentials.

• المصدر: ⚠️ https://gist.github.com/H3rmesk1t/ac6e91a8fba51002be085755c8bf7d43
• المستخدم: H3rmesk1t (UID 70306)
• ارسال: 14/09/2026 10:56 AM (21 أيام منذ)
• الاعتدال: 05/10/2026 12:17 AM (21 days later)
• الحالة: تمت الموافقة
• إدخال VulDB: 413465 [Totolink A3002MU 1.0.0-B20230403.1455 Authentication Check /bin/boa sub_40FCFC تجاوز الصلاحيات]
• النقاط: 20