CVE-2024-33113 Scanner

The D-LINK DIR-845L is a wireless router commonly used in homes and small offices for providing internet connectivity. Known for its reliability and ease of setup, it helps users manage their network traffic efficiently. Network administrators utilize it for its robust features like guest network access and parental controls. Its interface allows users to configure device settings and monitor network activities. With the ability to connect multiple devices, it serves as a central hub in a wireless network. Applied across different sectors, it provides essential connectivity with features tailored for user-friendly management.

The vulnerability in question is an Information Disclosure weakness affecting the D-LINK DIR-845L router. Information disclosure vulnerabilities expose sensitive data without authorization, which could include configuration files or logs. In this case, the flaw resides in how the device processes certain requests to the bsc_sms_inbox.php endpoint. Unauthorized users can exploit this flaw to access device-specific information, breaching confidentiality. Such vulnerabilities are critical as they can lead to exposure of data pivotal for an attacker to map and compromise a network.

Technical details of this vulnerability involve manipulation of HTTP GET requests where certain parameters are not duly sanitized. The request includes navigation to a getcfg.php script with parameters set to a specific unauthorized configuration, allowing access to internal device services. The '%0A_POST_SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1' in the URL triggers this vulnerability by improperly processing authentication levels. This allows the passing of control inputs directly to the application, which inadvertently discloses administrative details.

If exploited, this vulnerability can lead to serious consequences including unauthorized access to the router's configurations, user data, and even the potential to manipulate network traffic or configurations. Attackers could exploit this information to further penetrate a network, possibly launching additional attacks or causing service disruptions. The exposure of sensitive configuration data increases the risk of system vulnerabilities being exploited on a broader scale.

REFERENCES

• https://github.com/FaLLenSKiLL1/CVE-2024-33113
• https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md