4 ms·
Exploit is an HTTP request, so an attacker could send the request from javascript: any website could attack your router.
by sounds 13y ago
Exploit is an HTTP request, so an attacker could send the request from javascript: any website could attack your router.
- blueskin_ 13y agoJavascript WTF #27,903
- deleted 13y ago[deleted]
- _ikke_ 13y agoWouldn't Same-Origin-Policy prevent this?
- sounds 13y agoThe challenge would not be the Same Origin Policy, it would be finding out what IP address your router has. Browsers don't give that to Javascript (which is probably good). However, you'd be 99% successful trying the most common IPs first: 192.168.0.1 192.168.1.1 10.0.0.1 10.0.1.1 etc. Then the attacker just sets up a scripted DNS server under their domain, like this: 192.168.0.1.ip.example.com A 192.168.0.1 192.168.1.1.ip.example.com A 192.168.1.1 10.0.0.1.ip.example.com A 10.0.0.1 10.0.1.1.ip.example.com A 10.0.1.1 etc. As you can see, Same Origin Policy wouldn't prevent javascript from sending a POST request to a subdomain, and the attacker controls their DNS so getting an IP address isn't hard. (The DNS server uses a script instead of actually having all the IP addresses spelled out in a config file.)
- deanclatworthy 13y agoSurely this only affects routers whose control panel is running on an open port 80 and also remote access is enabled? Or is the point of this exploit that by default the router has port 80 open and remote login enabled?
- gibybo 13y agoIt wouldn't be remote login, it would be local login from the network, which routers tend to have enabled by default (how else would you manage them?).