99 lines
No EOL
2.6 KiB
Text
99 lines
No EOL
2.6 KiB
Text
GotGeek Labs
|
|
http://www.gotgeek.com.br/
|
|
|
|
TP-Link TL-PS110U & TL-PS110P Cross-site Scripting Vulnerability
|
|
|
|
|
|
|
|
[+] Description
|
|
|
|
TL-PS110U:
|
|
The TP-LINK TL-PS110U print server allows you to take the computer out
|
|
of the loop while setting up a printing network. All that is needed is to
|
|
connect the TL-PS110U to a printer via the USB port, connect the print
|
|
server to your LAN, and you will be able to access your printer from any
|
|
computer on the LAN.
|
|
|
|
TL-PS110P:
|
|
The TP-LINK TL-PS110P print server allows you to take the computer out
|
|
of the loop while setting up a printing network. All that is needed is to
|
|
connect the TL-PS110P to a printer via the parallel port, connect the print
|
|
server to your LAN, and you will be able to access your printer from any
|
|
computer on the LAN.
|
|
|
|
|
|
|
|
[+] Information
|
|
|
|
Title: TP-Link TL-PS110U & TL-PS110P Cross-site Scripting Vulnerability
|
|
Shodan Dork: ZOT-PS-47/9.8.0016 -WWW-Authenticate
|
|
ZOT-PS-30/8.3.0013 -WWW-Authenticate
|
|
Advisory: gg-006-2011
|
|
Date: 03-15-2011
|
|
Last update: 03-26-2011
|
|
Link: http://www.gotgeek.com.br/pocs/gg-006-2011.txt
|
|
|
|
|
|
|
|
[+] Vulnerabilities
|
|
|
|
Stored Cross-site Scripting:
|
|
Web interface from TL-PS110U and TL-PS110P Print Servers are affected by stored
|
|
cross-site scripting vulnerability because it fails to properly sanitize
|
|
user-supplied input at "NDSContext" field in "NetWare NDS Settings" area.
|
|
An attacker may leverage this issue to execute arbitrary script code
|
|
in the browser of an unsuspecting user in the context of the affected site.
|
|
|
|
After injecting the XSS code, you need to access Netware status page.
|
|
|
|
|
|
Affected Versions:
|
|
|
|
TP-Link TL-PS110U Network Print Server
|
|
Firmware: 9.08.47T 0016 (ZOT-PS-47/9.8.0016)
|
|
9.08.47T 0013 (ZOT-PS-47/9.8.0013)
|
|
6.03.35T 0007 (ZOT-PS-47/9.8.0007)
|
|
6.03.35T 0006 (ZOT-PS-47/9.8.0006)
|
|
6.03.35T 0005 (ZOT-PS-47/9.8.0005)
|
|
6.03.35T 0004 (ZOT-PS-47/9.8.0004)
|
|
|
|
TP-Link TL-PS110P Network Print Server
|
|
Firmware: 8.03.30T 0013 (ZOT-PS-30/8.3.0013)
|
|
8.03.30T 0009 (ZOT-PS-30/8.3.0009)
|
|
8.03.30T 0008 (ZOT-PS-30/8.3.0008)
|
|
|
|
Other versions may also be vulnerable.
|
|
|
|
|
|
|
|
[+] Proof of Concept/Exploit
|
|
|
|
XSS:
|
|
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>
|
|
|
|
and then..
|
|
|
|
http://target/NETWARE.HTM
|
|
|
|
|
|
|
|
[+] Timeline
|
|
|
|
24-03-2011: first contact to vendor.
|
|
27-03-2011: support contact response, asking more details.
|
|
27-03-2011: more information sent.
|
|
03-04-2011: no vendor response.
|
|
04-04-2011: advisory published.
|
|
|
|
|
|
|
|
[+] References
|
|
|
|
http://www.tp-link.com/products/productDetails.asp?class=&pmodel=TL-PS110U
|
|
http://www.tp-link.com/products/productDetails.asp?class=&pmodel=TL-PS110P
|
|
|
|
|
|
|
|
[+] Credits
|
|
|
|
b0telh0 |