CVE-2022-50804
📋 TL;DR
CVE-2022-50804 is a CSRF vulnerability in JM-DATA ONU JF511-TV version 1.0.67 that allows attackers to trick authenticated administrators into unknowingly executing malicious administrative actions. This affects organizations using this specific ONU device version for network termination. Attackers can exploit this by luring authenticated users to malicious web pages.
💻 Affected Systems
- JM-DATA ONU JF511-TV
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing network configuration changes, service disruption, credential theft, and potential lateral movement into connected networks.
Likely Case
Unauthorized configuration changes leading to service disruption, DNS/network redirection, or credential harvesting from the device.
If Mitigated
Limited impact with proper CSRF protections, network segmentation, and administrative access controls in place.
🎯 Exploit Status
Exploit requires social engineering to trick authenticated user. Proof-of-concept available in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.jm-data.com/
Restart Required: No
Instructions:
Check vendor website for firmware updates. If unavailable, implement workarounds and consider device replacement.
🔧 Temporary Workarounds
CSRF Token Implementation
allAdd anti-CSRF tokens to all administrative forms
SameSite Cookie Attribute
allSet SameSite=Strict attribute on session cookies
🧯 If You Can't Patch
- Segment ONU management interface to isolated VLAN with strict access controls
- Implement web application firewall with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at System > Status > VersionCheck Version:
curl -k https://[device-ip]/status.cgi | grep 'Firmware Version'Verify Fix Applied:
Test administrative forms for presence of CSRF tokens and validate SameSite cookie attributes📡 Detection & Monitoring
Log Indicators:
- Multiple administrative actions from same session in rapid succession
- Configuration changes from unexpected IP addresses
Network Indicators:
- HTTP POST requests to administrative endpoints without Referer headers
- Cross-origin requests to device management interface
SIEM Query:
source="onu_logs" AND (action="config_change" OR action="admin_action") AND referer="-"🔗 References
- https://cxsecurity.com/issue/WLB-2022060058
- https://exchange.xforce.ibmcloud.com/vulnerabilities/229355
- https://packetstormsecurity.com/files/167487/
- https://www.jm-data.com/
- https://www.vulncheck.com/advisories/jm-data-onu-jf-tv-cross-site-request-forgery-csrf-vulnerability
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5708.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5708.php
