SecurityvulnsSECURITYVULNS:DOC:18200[Full-disclosure] Netgear SSL312 XSS vulnerability
|| WWW.SMASH-THE-STACK.NET ||
|| ADVISORY: NETGEAR SSL312 XSS VULNERABILITY
|| 0x00: ABOUT ME
|| 0x01: DATELINE
|| 0x02: INFORMATION
|| 0x03: EXPLOITATION
|| 0x04: RISK LEVEL
|| 0x00: ABOUT ME
Author: SkyOut
Date: October 2007
Contact: skyout[-at-]smash-the-stack[-dot-]net
Website: www.smash-the-stack.net
|| 0x01: DATELINE
2007-10-08: Bug found
2007-10-09: Phone call with Netgear Germany
2007-10-09: Email with notification sent to Netgear Germany
2007-10-12: Still no reaction from Netgear Germany
2007-10-13: Advisory released
|| 0x02: INFORMATION
In the product "Netgear SSL312 PROSAFE SSL VPN-Concentrator 25",
which is a VPN router for smaller to medium business companies and
priced about 400 Euro, a bug occurs in the login page due to the
fact of an unfiltered variable. It is possible to execute JavaScript
code on the webinterface. It may be possible, that other products
of this series are vulnerable to this bug, too (not tested!).
|| 0x03: EXPLOITATION
To exploit this bug no exploit is needed, all can be done trough
the webinterface of the router in five simple steps:
STEP 1:
Go to the webinterface of the router, located at "/cgi-bin/welcome"
by default.
STEP 2:
Wihout giving any further parameters click LOGIN.
STEP 3:
An error page will occurr with a variable (default is "err") in the
URL. Example: "/cgi-bin/welcome/XYZ?err="
STEP 4:
Manipulate the URL and put your script code into the variable.
Demo: "/cgi-bin/welcome/XYZ?err=<script>alert('XSS');</script>"
STEP 5:
Click ENTER and the demo popup will show up. The script code has been
successfully executed.
|| 0x04: RISK LEVEL
I would consider this a smaller bug, that can only be used in very
specific situations. A successfull exploitation of this bug could
lead to Session Hijacking.
<!> Happy Hacking <!>
THE END
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/