CVE-2017-8337

Vulnerability

The web management interface on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096 does not validate the Origin header of HTTP requests. This missing check allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks against the device [1]. The vulnerability is present in the default configuration and does not require any special settings to be exploitable.

Exploitation

An attacker must trick a logged-in user into visiting a malicious webpage while the user is authenticated to the device. The attacker can then send crafted requests to the device's web interface to brute force the administrator password or directly execute other actions, such as modifying management rules or interacting with sensors attached to the device via websocket requests [1][2]. No additional authentication or network position is required beyond the victim's authenticated session.

Impact

Successful exploitation allows an attacker to gain unauthorized access to the web management interface. The attacker can change device rules, access sensor data, and fully compromise the device's configuration. This leads to loss of confidentiality and integrity of the device's operations [1].

Mitigation

No official patch or firmware update has been released by Securifi to address this vulnerability according to the available references [1][2]. Until a fix is provided, users should avoid accessing the device's web interface while browsing untrusted sites and consider restricting network access to the management interface.