How to configure Chrome to stop external websites accessing my router?

Question

Yet another serious router vulnerability has been disclosed: https://www.exploit-db.com/exploits/40889/

This is a command execution vulnerability through the web interface. I'm not too concerned about internal users being able to exploit it; I only allow trusted people on my network. However, a major concern is that external web sites could exploit it as a CSRF attack.

How can I configure Chrome to prevent external web sites referencing or redirecting to my router? Ideally I'd like to still be able to manually browse to the router admin page, although I guess I can live without that.

For FireFox, the NoScript plugin can do this using ABE - Application Boundaries Enforcer.

As a workaround I have patched the router and put it on a non-predictable IP address. However, that's only a partial solution as further issues are likely to appear in future, and there are various ways for web pages to access private IP addresses (e.g. WebRTC, Java).

Answer 1

There is no built-in way to block CSRF from inside Chrome and actually cross site requests which might look like CSRF are often used for a valid purpose like single sign on or use of a payment service.

There are some Chrome extensions which help you to deal with CSRF. Apart from that you might try to setup a proxy policy using a local PAC file where you forbid access to your router. But, as long as the router accepts requests with any hostname the attacker can work around this filter with some DNS tricks like returning the routers local IP address in the DNS record for attacker.example.com. Apart from that you might add a local firewall rule outside the browser which prohibits access to the router at all from your system.
The best way would of course would be if the router would not be vulnerable from start.

Answer 2

While you may not be able to protect yourself from CSRF in general, it should be possible to do this for the limited feature set of your router.

While NoScripts ABE is pretty good, a sort-of poor-mans alternative here would be to use your content filtering browser extension of choice (I recommend uBlock Origin, but any that let you make custom filters should work). Just create a custom filter to block access to your router's IP address and hostname (if your router has a hostname).

Then when you want to access the router's admin panel, which I presume is not regularly, just disable the ad blocker temporarily or use an alternate browser for this purpose.