exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ProCheckUp Security Advisory 2007.40

ProCheckUp Security Advisory 2007.40
Posted Nov 19, 2008
Authored by Adrian Pastor, ProCheckUp | Site procheckup.com

The 3Com AP 8760 suffers from authentication bypass, password leakage, and SNMP injection vulnerabilities. Details provided.

tags | exploit, vulnerability
SHA-256 | 23b5cdcfae6b89704fccdcebd00d1ae55e3f48331216d43a26e85f5664b02003

ProCheckUp Security Advisory 2007.40

Change Mirror Download
PR07-40: Authentication Bypass, Passwords Leakage and SNMP Injection on
3Com AP 8760

Vulnerability Found: 6th November 2007

Vendor Informed: 2nd May 2008

Date Public: 14th November 2008

Severity: Medium

Credits: Adrian Pastor of ProCheckUp Ltd (www.procheckup.com).

Vulnerability #1:


The HTTP authentication mechanism of the 3Com AP 8760 works as follows:

1. Router checks if credentials submitted by user are valid

2. If valid, the router's web interface redirects the user to URLs that
should only be available to authenticated admin users

What's important to note is that every time an "authenticated" URL is
accessed, there is _no_ authentication data being sent within HTTP
requests whatsoever. There are no passwords, or session IDs being
submitted at all within HTTP requests. Instead, the AP uses the
administrator's source IP address as authentication data.

This means that the authentication state relies on the false assumption
that post-authentication URLs won't be known by an attacker and that the
attacker and the administrator will _not_ share the same source IP
address. By simply accessing administrative URLs in a browser from _the
same IP address_ (i.e.: by sharing the same proxy or NATed IP address),
the authentication check can be bypassed completely.


Although URL paths are different, these issues appear to be similar to
those found on other 3com router models:


Proof of concept:

The following is an example of an administrative page that would allow
an attacker to change settings:


Vulnerability #2:


Additionally, sensitive data such as the admin password is returned
within certain pages. Although after bypassing the authentication the
attacker wouldn't need to know the admin password anyway, this could be
handy for a cracker in scenarios such as the following:

1. The authentication bypass is fixed by updating the firmware to a
patched version (attacker would still be able to access the device since
he/she knows the admin password)

2. The attacker could try the same password on other servers owned by
the same target company since it's a common human weakness to reuse

Proof of concept:

The following URLs return the admin password within 'hidden' form fields:


Vulnerability #3:


It's possible to launch SNMP injection attacks. By changing the system
name via SNMP, it's possible to inject a persistent XSS payload on
several pages including the _login page_. Thus, the attacker has an
opportunity to redirect the admin password to his own site by
overwriting the login form's action attribute.

The payload gets returned within the login page's 'title' tag. i.e.:

<title>3Com Wireless 8760 Dual Radio 11a/b/g Access Point

Example of snmpset command that changes the AP's system name:

snmpset -v2c -c private sysName.0 s "PAYLOAD_GOES_HERE"

Successfully tested on:

3COM: AP8760: Dual Radio 11a/b/g Access Point, Software v2.1.13b05_sh,
Bootrom v1.2.1, Hardware R02

Note: model and firmware info extracted via SNMP from
'SNMPv2-MIB::sysDescr.0' OID.


Administrative access can be gained to the device without knowledge of
the admin password. The caveat is that the attacker must share the same
source IP address with the administrator. Therefore, this vulnerability
would mostly be exploited by internal users only. Sensitive information
such as administrative credentials can be obtained.

Admin passwords can be compromised given that an attacker has first
gained SNMP write access.


No workaround is available for the authentication bypass and passwords
leakage issue. SNMP injection can be resolved by disabling SNMP write




Copyright 2008 Procheckup Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if, the Bulletin is not edited or changed in any way, is
attributed to Procheckup, and provided such reproduction and/or
distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not
liable for any misuse of this information by any third party.
Login or Register to add favorites

File Archive:

June 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    18 Files
  • 2
    Jun 2nd
    13 Files
  • 3
    Jun 3rd
    0 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    32 Files
  • 6
    Jun 6th
    39 Files
  • 7
    Jun 7th
    22 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By