CVE-2020-35391 PoC — Tenda N300 资源管理错误漏洞

Source

https://github.com/dumitory-dev/CVE-2020-35391-POC

Associated Vulnerability

Title:Tenda N300 资源管理错误漏洞 (CVE-2020-35391)
Description:Tenda N300是中国腾达（Tenda）公司的一款路由器。 Tenda N300 F3 12.01.01.48 存在安全漏洞，该漏洞允许远程攻击者可利用该漏洞通过直接请求cgi-bin DownloadCfg RouterCfm获取敏感信息(可能包括http密码行)。

Description

Tenda N300 Authentication Bypass via Malformed HTTP Request Header

Readme

<h1 align="center">Welcome to CVE-2020-35391-POC 👋</h1>
<p>
  <a href="https://signalhilltech.medium.com/tenda-malformed-http-request-header-processing-vulnerability-ade4b3cdefb4" target="_blank">
    <img alt="Original Documentation" src="https://img.shields.io/badge/documentation-yes-brightgreen.svg" />
  </a>
  <a href="https://mit-license.org/" target="_blank">
    <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
  </a>
  <a href="https://github.com/dumitory-dev/CVE-2020-35391-POC/actions/workflows/pylint.yml" target="_blank">
    <img alt="Pylint" src="https://github.com/dumitory-dev/CVE-2020-35391-POC/actions/workflows/pylint.yml/badge.svg" />
  </a>
</p>

Tenda N300 Authentication Bypass via Malformed HTTP Request Header Python  POC
<br>
<br>
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.
<br>
<br>
***Original PoC Author: Michelle Bonilla***
<br>
After so much time since this CVE was published, the vulnerability has still not been fixed! (Last Firmware Version: V12.01.01.42_multi)

## Usage

```sh
python3 main.py <router ip>
```

## Work example

<img src="./img/work.gif" width="650" height="350" />

## Author

👤 **dumitory-dev**


## Show your support

Give a ⭐️ if this project helped you!

## 📝 License

This project is [MIT](https://mit-license.org/) licensed.

File Snapshot


 [4.0K]  /data/pocs/d3990b1ae8710a114f8688b36fe2724cc77dcfe9
├── [4.0K]  img
│   └── [239K]  work.gif
├── [1.0K]  LICENSE
├── [2.3K]  main.py
└── [1.7K]  README.md

1 directory, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!