exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Novatel Wireless MiFi Cross Site Request Forgery

Novatel Wireless MiFi Cross Site Request Forgery
Posted Jan 18, 2010
Authored by Adam Baldwin

Novatel Wireless Mifi suffers from cross site request forgery, output encoding, gps enabling, and authentication vulnerabilities.

tags | advisory, vulnerability, csrf
SHA-256 | b07c73a7c1c8cca6d14d3e4157f32c6256bcf8e00e3240328484ee58d974ad1e

Novatel Wireless MiFi Cross Site Request Forgery

Change Mirror Download
The MiFi by Novatel Wireless (re-branded and sold by multiple vendors
such as Sprint and Verizon) is a mobile wifi hotspot. The mifi also has
a built in GPS to provide location based searching.

Turns out that the web interface to this little device has a lot going
on that can be exploited, from gaining the user’s GPS data to
terminating the user’s connectivity. The POC isn't online yet due to
vendor lag but it's not all that complicated if you have a MiFi and a
few minutes.

*1. Authentication not required.*

The MiFi does not require a valid session to commit changes to
configuration settings. This makes exploiting the below issues a lot
easier when you don’t have to require that the victim have a valid session.

*2. Enable GPS without the users knowledge.*

The GPS on a MiFi can be enabled by visiting the following URL.
Depending on the situation the victim may get a alert that says “Login
Required” but if they are like the typical user they will simply click
on it and forget it ever happened.

*3. Cross-Site Request Forgery (CSRF)*

The web interface does not validate referrer or use any magical tokens
to protect against CSRF. This means that we can have a victim visit our
malicious website and do evil things like change the wireless settings
of the MiFi.

*4. Output Encoding

In multiple locations of the MiFi web interface user input is not
properly encoded when output back to the user. One interesting location
is the key field for the wifi settings. I’m wondering why the hell
somebody thought it was a good idea to print the wifi key in clear text
back to the user, and in this case it’s not properly encoded either
giving us a nice 63 character persistent injection point for script.

So for those that weren’t paying attention: Any MiFi user that visits a
specially crafted page will give up their GPS location to the attacker.

Here is a video clip for the Sprint MiFi (latest firmware) of the
working proof of concept.

Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By