MITRE - Privilege Escalation in D-Link DSL-7740C Web Portal from Low Privilege User

MITRE - Privilege Escalation in D-Link DSL-7740C Web Portal from Low Privilege User.md

Affected component(s)

D-Link DSL7740C Modem Firmware Version DSL7740C.V6.TR069.20211230 - Web Portal Maintenance Function

Attack vector(s)

Web-based interface accessible by low privilege users.

Suggested description of the vulnerability for use in the CVE

This critical vulnerability allows a low privilege user to escalate their privileges through the web portal by changing the password of a high privilege user account. After successfully changing the password, the attacker can log in with full administrative rights.

Detail Description

The vulnerability occurs within the "Maintenance" tab of the web portal where users are allowed to change passwords. A flaw in the handling of network requests permits modification of parameters intended for lower privileged accounts to affect higher privileged accounts instead.

Steps to Reproduce:

1. Log in as a low privilege user.
2. Navigate to the "Maintenance" tab.
3. Intercept the network request using Burp Suite or another proxy tool when attempting to change the password.
4. The original GET request appears as follows:

GET /MAINTENANCE/mt_admin.xgi?save=true&set/sys/user:2/name=user&set/sys/user:2/password=user&EXE=chtlog,log2&CMT=0&sessionkey=373389020 HTTP/2

This request sets the password for the low privilege user (user:2) to "user".

5. Modify the parameter set/sys/user:2/password=user to set/sys/user:1/password=newpassword where newpassword is your desired password for the high privilege user (user:1).
6. Submit the modified request.

Impact

This vulnerability allows unauthorized users to gain administrative access to the device, leading to potential misuse such as altering configuration settings, disabling security features, or gaining access to sensitive data. The impact is severe due to the ease of exploitation and the level of access gained.

Proof of Concept

The following screenshots demonstrate the process:

• Initial password change request intercepted:

• Modified request targeting the high privilege user:

After modifying the privileged user's password to user1, verification can be done via querying the system database using tools like xmldbc and decrypting it with alphadec. The password changes from its original hash 740c<REDACTED> to the plaintext user.

Credits

• Chiao-Lin Yu (Steven Meow)

Report Date

• 2025/03/03