5

Yet another serious router vulnerability has been disclosed: https://www.exploit-db.com/exploits/40889/

This is a command execution vulnerability through the web interface. I'm not too concerned about internal users being able to exploit it; I only allow trusted people on my network. However, a major concern is that external web sites could exploit it as a CSRF attack.

How can I configure Chrome to prevent external web sites referencing or redirecting to my router? Ideally I'd like to still be able to manually browse to the router admin page, although I guess I can live without that.

For FireFox, the NoScript plugin can do this using ABE - Application Boundaries Enforcer.

As a workaround I have patched the router and put it on a non-predictable IP address. However, that's only a partial solution as further issues are likely to appear in future, and there are various ways for web pages to access private IP addresses (e.g. WebRTC, Java).

2

There is no built-in way to block CSRF from inside Chrome and actually cross site requests which might look like CSRF are often used for a valid purpose like single sign on or use of a payment service.

There are some Chrome extensions which help you to deal with CSRF. Apart from that you might try to setup a proxy policy using a local PAC file where you forbid access to your router. But, as long as the router accepts requests with any hostname the attacker can work around this filter with some DNS tricks like returning the routers local IP address in the DNS record for attacker.example.com. Apart from that you might add a local firewall rule outside the browser which prohibits access to the router at all from your system.
The best way would of course would be if the router would not be vulnerable from start.

  • Thanks. Good point about DNS rebinding. The CSRF plugins seem to just restrict cookies, but the vuln is exploitable without any cookies. Would have thought Chrome had an equivalent to NoScript ABE but can't find it. – paj28 Dec 12 '16 at 12:12
  • @paj28: if the router might be this broken that unauthorized RCE is possible then the only way is probably to make it inaccessible from your system. BTW, I did not refer to DNS rebinding (i.e. change of IP) but to a fixed binding of an outside hostname to a local IP address. This would be enough to bypass such a PAC restriction. – Steffen Ullrich Dec 12 '16 at 12:17
  • Ok. BTW, you miss the point a bit about the router not being vulnerable. Sure I can patch the router - but who knows how many other bugs lurk undiscovered. Better to reduce attack surface. – paj28 Dec 12 '16 at 12:24
  • 1
    @paj28: That was more a wish than a recommendation. Wouldn't it be nice if router vendors would take more care of security up-front, i.e. threat analysis, security by design, certifications etc? – Steffen Ullrich Dec 12 '16 at 12:29
  • I've been trying to configure Windows Firewall to block Chrome access to the router's IP. Not having much luck - Chrome can still access it. Have you got any ideas? I wonder if the browser processes don't access the network directly, but do IPC to another process? – paj28 Dec 15 '16 at 9:37
2

While you may not be able to protect yourself from CSRF in general, it should be possible to do this for the limited feature set of your router.

While NoScripts ABE is pretty good, a sort-of poor-mans alternative here would be to use your content filtering browser extension of choice (I recommend uBlock Origin, but any that let you make custom filters should work). Just create a custom filter to block access to your router's IP address and hostname (if your router has a hostname).

Then when you want to access the router's admin panel, which I presume is not regularly, just disable the ad blocker temporarily or use an alternate browser for this purpose.

  • Thanks! I just looked at uBlock Origin, and it only seems to allow filtering by host name. Steffen Ullrich pointed out that someone could make blahblah.evil.com point to 192.168.0.254 - making a host name filter pretty ineffective. Can it do filtering by IP address? – paj28 Dec 13 '16 at 17:37
  • @paj28 Hmm, good point. I suspect that host name trick would probably bypass any direct IP filters. Bummer. – Alexander O'Mara Dec 13 '16 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.