Legrand BTicino Driver Manager F454 1.0.51 CSRF Change Password Exploit

Title: Legrand BTicino Driver Manager F454 1.0.51 CSRF Change Password Exploit
Advisory ID: ZSL-2019-5521
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 15.05.2019
Summary
Audio/video web server for the remote control of the system using web pages or the MY HOME portal. The device can operate as a gateway for the use of the MHVisual and Virtual Configurator software - 6 DIN modules. It replaces item F453 and F453AV.
Description
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Vendor
BTicino S.p.A. - https://www.bticino.com
Affected Version
Hardware Platform: F454
Firmware version: 1.0.51
Driver Manager version: 1.1.14
Tested On
Apache/2.2.14 (Unix)
OpenSSL/1.0.0d
PHP/5.1.6
Vendor Status
[30.04.2019] Vulnerability discovered.
[01.05.2019] Vendor contacted.
[01.05.2019] Vendor responds, employee from BTicino will contact us.
[14.05.2019] No reply from the vendor.
[15.05.2019] Public security advisory released.
PoC
legrand_csrf.html
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] https://www.exploit-db.com/exploits/46850
[2] https://exchange.xforce.ibmcloud.com/vulnerabilities/161088
[3] https://packetstormsecurity.com/files/152940
Changelog
[15.05.2019] - Initial release
[17.05.2019] - Added reference [2[ and [3]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk