D-Link DWC-1000 up to 4.2.0.6_WW /platform.cgi thispage path traversal

Summaryinfo

A vulnerability, which was classified as critical, has been found in D-Link DWC-1000 up to 4.2.0.6_WW. Affected by this issue is some unknown functionality of the file /platform.cgi. Performing a manipulation of the argument thispage results in path traversal. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in D-Link DWC-1000 up to 4.2.0.6_WW. It has been classified as critical. This affects an unknown functionality of the file /platform.cgi. The manipulation of the argument thispage with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality.

The weakness was published 05/10/2014 with Holistic Security Consulting as SAP10026 as confirmed advisory (Website). The advisory is shared at securityadvisories.dlink.com. The public release has been coordinated with D-Link. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue. The advisory points out:

The DWC-10000 contains a flaw exploited by a null byte injection attack in the URL that allows directory/file/path traversal. All files on the system can be seen, including but not limited to /etc/shadow, /etc/passwd and temporary configuration files. A malicious user can successfully logon using the credentials stored within some of the files, which may lead to unauthorized configuration changes and/or the device becoming unstable.

A public exploit has been developed in HTTP POST Request and been published immediately after the advisory. The exploit is shared for download at securityadvisories.dlink.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 46 days. During that time the estimated underground price was around $5k-$25k. The code used by the exploit is:

POST /platform.cgi HTTP/1.1
Host: 192.168.7.2
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 199
 
thispage=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fteamf1.cfg.ascii%00index.htm&Users.UserName=admin&Users.Password=b&button.login.Users.deviceStatus=Login

Upgrading to version 4.2.0.6b303_WW eliminates this vulnerability. The upgrade is hosted for download at ftp2.dlink.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Secunia (SA58560†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• D-Link

Name

• DWC-1000

Version

• 4.2.0.6_WW

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion