D-Link DIR-615 up to 20.12 Web Interface Form2File.htm POST Request cross-site request forgery

Summaryinfo

A vulnerability classified as problematic was found in D-Link DIR-615 up to 20.12. This vulnerability affects unknown code of the file Form2File.htm of the component Web Interface. Executing a manipulation as part of POST Request can lead to cross-site request forgery. This vulnerability appears as CVE-2017-7404. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in D-Link DIR-615 up to 20.12 (Router Operating System). This vulnerability affects an unknown function of the file Form2File.htm of the component Web Interface. The manipulation as part of a POST Request leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials (CSRF). An attacker can host a page that sends a POST request to Form2File.htm that tries to upload Firmware to victim's Router. This causes the router to reboot/crash resulting in Denial of Service. An attacker may succeed in uploading malicious Firmware.

The bug was discovered 03/12/2017. The weakness was presented 07/07/2017 (Website). The advisory is shared for download at ftp2.dlink.com. This vulnerability was named CVE-2017-7404 since 04/03/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 117 days. During that time the estimated underground price was around $5k-$25k. By approaching the search of inurl:Form2File.htm it is possible to find vulnerable targets with Google Hacking. The commercial vulnerability scanner Qualys is able to test this issue with plugin 43507 (D-Link Router DIR-615 Multiple Vulnerabilities).

Upgrading to version 20.12PTb04 eliminates this vulnerability.

See VDB-103349 and VDB-103350 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-615

Version

• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion