ISE SOHO Vulnerability Catalog Published - Independent Security ...

ASUS RT-­‐N56U
Vulnerability: Cross-­‐Site Request Forgery
CVE: CVE-2013-3093
Description
The ASUS RT-N56U router is susceptible to several Cross-Site Request Forgery attacks,
which allows an attacker to forge HTML forms and execute actions on behalf of the
target user. ISE created a proof of concept that when executed by an unsuspecting user,
changes the administrator credentials, enables remote management, and gives the attacker
reverse-shell access to the router.
Attack Requirements
♦ The victim must have an active web application session on their ASUS router.
♦ The victim must follow a link crafted by an attacker (e.g., by clicking the link
directly, or through some other mechanism such as redirection from a malicious
site).
♦ The victim must have the necessary permissions to render and execute the forged
HTTP.
Details
All HTML forms present in the ASUS RT-N56U are susceptible to Cross-Site Request
Forgery.
Impact
If an unauthenticated remote attacker is able to fool an authenticated user into clicking a
malicious link, the attacker is able to launch an attack that has the capability to
compromise the router.
Recommendations to the Vendor
♦ Including an unpredictable token in each HTTP request submitted to the web
server can prevent Cross-Site Request Forgery. At a minimum, these tokens
should be unique to each user, but it is recommended that each HTML form
contain unique tokens.
♦ In addition to HTML form tokens, HTTP referrer checking should be enabled.
♦ Additional information for vendors regarding immediate and long term fixes for
these issues can be found here: http://www.securityevaluators.com/content/casestudies/routers/#recommendationsVendors
88