AOH :: HP Unsorted A :: BT-21046.HTM

ASMAX AR 804 gu Web Management Console Arbitrary Shell Command Injection Vulnerability



ASMAX AR 804 gu Web Management Console Arbitrary Shell Command Injection Vulnerability
ASMAX AR 804 gu Web Management Console Arbitrary Shell Command Injection Vulnerability



1. ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces.

2. There is an *unauthenticated* maintenance script (named 'script') in /cgi-bin/ directory of the web management interface.

3. When 'system' paramether is passed to the script it allows running OS shell commands (as root).

4. PoC:
GET request to:
http://192.168.1.1/cgi-bin/script?system%20whoami 

Returns:
root

5. Using CSRF attack one could remotely own a router using for example simple  html tags pointing to http://192.168.1.1/... 

6. The issue was tested on firmware: 66.34.1

7. The vendor was notified on 30.12.08, but we got no reasonable response till now (the bug remains unpatched).

8. More information: http://www.securitum.pl/dh/asmax-ar-804-gu-compromise 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.