scip_Advisory 3808 - D-Link DIR-100 long url filter evasion

http://www.scip.ch/?vuldb.3808

D-Link DIR-100 is a small and cost-effective router and firewall device for small offices and home users.

Marc Ruef at scip AG found a possibility to evade url filters of the web proxy to prevent access to web sites. An attacker might add a very long string to the url to access web resources althought their access is forbidden. It is possible to exploit the vulnerability with a common web browser by using a long url (approx. 1'300 chars). You can expand the length of the url by adding a non-used http get request parameter.

Detection of web based attacks requires a specialized web proxy and/or intrusion detection system. Patterns for such a detection are available and easy to implement.

We have informed D-Link on an early stage. Our technical requests were not answered nor confirmed. Therefore, not official statement, patch or upgrade is available. We suggest the use of another device for filtering forbidden web resources successfully.

Category:

Science & Technology

Tags:

• scip
• advisory
• vulnerability
• exploit
• d-link
• dir-100
• long
• url
• filter
• proxy
• evasion
• heise

[ne0sn1ff3r]

w00t I bought this router today... well, I'm not going to censorship my home anyways lol.