quote:

---

A hacker has discovered a critical vulnerability in open-source firmware available for wireless routers made my Linksys and other manufacturers that allows attackers to remotely penetrate the device and take full control of it.

The remote root vulnerability affects the most recent version of DD-WRT, a piece of firmware many router users install to give their device capabilities not available by default. The bug allows unauthenticated users to remotely gain root access simply by luring someone on the local network to a malicious website.

"This means someone can even post some crafted [img] link on a forum and a dd-wrt router owner visiting the forum will get owned," a user named Leka Vecher "gat3way" wrote in this posting to Milw0rm. "A weird vulnerability you're unlikely to see in 2009 Quite embarrassing I would say."

Messages sent through the DD-WRT website to the software designers weren't returned by time of publication, but comments posted to this user forum thread said the vulnerability affected the most recent builds, prompting a user by the name of autobot to declare the vulnerability a "mini code red."

The bug resides in DD-WRT's hyper text transfer protocol daemon, which runs as root. Because the httpd doesn't sanitize user-supplied input, it's vulnerable to remote command injection. While the httpd doesn't listen on the outbound interface, attackers can easily access it using CSRF (cross-site request forgery) techniques.

What's more, exploits need not be part of an authenticated session, making them easy to carry out. Examples of URLs that allow remote takeover include:

»routerIP/cgi-bin/;command_to_execute

or even:

DD-WRT is open-source firmware that runs more than 200 different models of wireless routers and embedded devices, including those made Linksys, D-Link, Buffalo, and Netgear. If you don't know whether your device uses it, chances are it does not. Penetration testers using the Metasploit project can download this module to audit whether a particular piece of hardware is vulnerable.

Additional details about the bug are here and here. ®
Update

DD-WRT developer Sebastian Gottschall just emailed to say an interim fix is available here. "Consider that this exploit was released without any Report to us," he added.

---

quote:

---

DD-WRT developer Sebastian Gottschall just emailed to say an interim fix is available here. "Consider that this exploit was released without any Report to us," he added.

---

quote:

---

DD-WRT is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with superuser privileges, which may facilitate a complete compromise of the affected device.

DD-WRT v24-sp1 is affected; other versions may also be vulnerable.

Bugtraq ID: 35742
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Jul 20 2009 12:00AM
Updated: Jul 20 2009 09:56PM
Credit: gat3way
Vulnerable: DD-WRT DD-WRT v24.sp1
DD-WRT DD-WRT v24-sp1
DD-WRT DD-WRT v24

---

quote:

---

I briefly read about this yesterday, but didn't look into it.
And so, I was under the wrong impression that this was something that can happen from the outside, hacking directly into the router, simply by coming across a vulnerable router.

But that is not the case.

It needs a facilitator. And that facilitator is your browser.

So the exploit has to come across the web & into your browser. Then your browser has to allow the action. So if the action is blocked by the browser (& a NoScript/ABE enabled browser, does - you say), then the exploit is thwarted.

And just how does NoScript/ABE stop this attack?

# Prevent Internet sites from requesting LAN resources. Site LOCAL Accept from LOCAL Deny
And I guess that is what does it. But just what does that mean, in simple terms?

---

quote:

---

In simple terms it means that, just like any site can link any other site and even navigate automatically (e.g. when a web site loads a 3rd party image or iframe), a malicious site can let your browser navigate automatically (and invisibly, e.g. using an invisible iframe or a 0 sized image) to your router's web UI (or any web application inside your LAN).
If said router or intranet application lacks of sufficient authorization checks (e.g. because it's confident about hosts in the LAN being trusted by IP) or if you're just already logged in or you're using the default password or, like in this case, it is just vulnerable because of a bug, the malicious web page can interact with the "private" resource just like it was you.

What ABE does with the SYSTEM "LocalRodeo-like" rule is preventing any external (internet) web site/application from initiating requests towards internal (LAN) resources.

---

quote:

---

would the attacker need to know the ip address of the router and use that in their CSRF attack?

---

quote:

---

Unlike the already documented CSRF vulnerability ( »www.securityfocus.com/bid/32703 ) this DOES NOT need an authenticated session. This means someone can even post some crafted [img] link on a forum and a dd-wrt router owner visiting the forum will get owned

---

quote:

---

Note: The exploit can only be used from outside your network over the internet if you have enabled remote Web GUI management in the Administration tab. As immediate action please disable the remote Web GUI management.

---