0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection Vulnerability
[Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection [*] Overview Sierra Wireless produces a mobile wi-fi hotspot device that is popular amongst telecommunication companies for re-branding to suit local markets. The AirCard 760S/762S/763S Web-based Administrative Console suffers from a HTTP header injection that allows an attacker to inject a file into the HTTP response from the device. [*] Description The configuration export function allows the name of the exported configuration file to be customised, but the parameter "save" is not filtered. http://<routerURL>/export.cfg?save=export.cfg [*] Traffic sample from POC (curl -L) (sample below tested on firmware SWI9200H2_03.05.11.00AP) > GET /export.cfg?save= > export.bat%0d%0aContent-type:%20application/bat%0d%0a%0d%0apause%0d%0a > &sessionId=00000001%2DhYL4H > 4jC125ApaZyFCHePwPINyFUdYf HTTP/1.1 > > User-Agent: curl/7.40.0 > > Host: router.4g > > Accept: */* > > > < HTTP/1.1 200 OK > < Server: httpd/2.7 (sierra; D4C) > < Date: Mon, 12 Jan 2015 05:32:38 GMT > < Connection: keep-alive > < Cache-Control: no-cache > < Content-Disposition: attachment; filename=export.bat > < Content-type: application/bat > > pause > Content-type: application/octet-stream > Transfer-encoding: chunked > 3a > # > # Configuration export from Telstra WI-FI 4G > # > # Model: [*] Limitations While it does not require authentication, it does require user interaction and knowledge of the hotspot's hostname. However, the default hotspot names are well-known, based on the OEM'd version of the AirCard Mobile Hotspot: * 763S - Sierra Wireless Original OEM - http://aircard.hotspot * 763S - Rogers Rocket Mobile Hotspot - http://rogers.hotspot * 762S - DNA 4G WLAN Mokkula - http://dna.mokkula * 760S - Telstra Mobile WiFi 4G - http://telstra.4g * 760S - BigPond Mobile - http://bigpond.4g [*] Workaround Change the name and IP address of the device to something other than the default settings. [*] Vendor Contact An attempt to contact both Sierra Wireless and NETGEAR (who seem to own support of the device now) was unsuccessful. regards , Luke # 0day.today [2024-11-14] #