CVE-2024-4963
📋 TL;DR
This critical vulnerability in D-Link DAR-7000-40 allows remote attackers to upload arbitrary files via the /url/url.php endpoint due to unrestricted file upload. This can lead to complete system compromise. Only affects end-of-life products that are no longer supported by the vendor.
💻 Affected Systems
- D-Link DAR-7000-40
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Webshell deployment allowing unauthorized access, file manipulation, and potential lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation and file upload restrictions are in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub repository. Simple file upload manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
Restart Required: No
Instructions:
No official patch available. Vendor recommends retiring and replacing the end-of-life device.
🔧 Temporary Workarounds
Block /url/url.php access
linuxUse web application firewall or network firewall to block access to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/url/url.php" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/url/url.php" --algo bm -j DROP
Disable file upload functionality
allModify web server configuration to disable file uploads if possible
🧯 If You Can't Patch
- Immediately isolate device from internet and place behind strict firewall rules
- Implement network segmentation to limit device access to only necessary services
🔍 How to Verify
Check if Vulnerable:
Check device version via web interface or CLI. If version is V31R02B1413C, device is vulnerable.Check Version:
Check web interface at System > Status or use device-specific CLI commandsVerify Fix Applied:
No fix available to verify. Only mitigation is device replacement.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /url/url.php
- POST requests with file upload parameters to vulnerable endpoint
- Unexpected PHP file creation in web directories
Network Indicators:
- HTTP POST requests to /url/url.php with file upload content
- Unusual outbound connections from device after exploitation
SIEM Query:
source="web_logs" AND uri="/url/url.php" AND method="POST" AND (file_upload OR upload)🔗 References
- https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20url.php.pdf
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
- https://vuldb.com/?ctiid.264531
- https://vuldb.com/?id.264531
- https://vuldb.com/?submit.333781
- https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20url.php.pdf
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
- https://vuldb.com/?ctiid.264531
- https://vuldb.com/?id.264531
- https://vuldb.com/?submit.333781
