Linksys WAP54Gv3 固件'debug.cgi'跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1179024 漏洞类型 跨站脚本
发布时间 2010-06-28 更新时间 2010-06-28
CVE编号 CVE-2010-2506 CNNVD-ID CNNVD-201006-445
漏洞平台 N/A CVSS评分 2.9
|漏洞来源
https://www.securityfocus.com/bid/73603
https://cxsecurity.com/issue/WLB-2010060207
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201006-445
|漏洞详情
LinksysWAP54Gv3是一款无线路由器设备。LinksysWAP54Gv3固件3.05.03和3.04.03的debug.cgi存在跨站脚本攻击漏洞。远程攻击者可以借助data1参数注入任意的web脚本或者HTML。
|漏洞EXP
Security Advisory

IS-2010-003 - Linksys WAP54Gv3 debug.cgi Cross-Site Scripting

Advisory Information
--------------------
Published (dd/mm/yy):
23/06/2010

Updated (dd/mm/yy):
23/06/2010

Manufacturer: Linksys
Model: WAP54G
Hardware version: v3.x
Firmware version: ver.3.05.03 (Europe)
          ver.3.04.03 (US)

Vulnerability Details
---------------------
Class:
Cross-Site Scripting

Public References:
Not Assigned

Platform:
Successfully tested on Linksys WAP54Gv3 loaded with firmware version
Ver.3.05.03 (Europe)
Vulnerability present also on firmware ver.3.04.03 (US)
Other models and/or firmware versions may be also affected.

Background Information:
Linksys WAP54G is a wireless access points that allow wireless clients
connectivity to wired networks.
Supported 802.11b and 802.11g protocols, with data rates up to 54Mbit/s.

Summary:
A cross-site scripting vulnerability is present in the debug.cgi page,
that is accessible by using proper debug credentials

Details:
The debug.cgi page act as debug interface for the Linksys WAP54Gv3 and
is accessible by authenticating with proper debug credentials at the
following URL:

http://AP_IP_ADDR/debug.cgi

where AP_IP_ADDR is the IP address of the device.

Commands to be executed by the system are sent within the data1 POST
variable, while the command output is returned within a <textarea> tag
in the output html page.
Output is not sanitized in any way, allowing for a Cross-site scripting
condition that can be triggered by any command that includes a
</textarea> closing tag in its output.
Additional text following such tag will be interpreted as regular HTML
by the accessing user browser, allowing for injection of Javascript
code, that will be run in the context of the presented web page.

Proof of Concept:
echo "</textarea><script>alert('XSS');</script>"

Impacts:
The vulnerability may allow an attacker to access the output of commands
during a "Remote blind" attack, where malicious web pages are used by
the attacker over the Internet to execute code on a victim access point
with private addressing, by leveraging an user browser as a 3rd party
"reflector".
This would also allow an attacker to extract information and
configuration stored on devices that are not even able to access the
Internet (eg: firewall policy, gateway not configured)

Solutions & Workaround:
Not available

Additional Information
----------------------
Timeline (dd/mm/yy):
09/11/2009: Requested Point of Contact to Linksys
10/11/2009: Received Point of Contact
10/11/2009: Vulnerability details sent
12/11/2009: Received clarification request on firmware version
12/11/2009: Additional details sent
16/01/2010: Requested update on vulnerability status.
----------- No update received -----------
23/06/2010: This advisory

Additional information available at http://www.icysilence.org

|受影响的产品
Cisco Linksys Wap54g 0 Cisco Linksys Firmware 3.05.03 Cisco Linksys Firmware 3.04.03
|参考资料

来源:XF
名称:wap54gv3-debug-xss(59699)
链接:http://xforce.iss.net/xforce/xfdb/59699
来源:BUGTRAQ
名称:20100623IS-2010-003-LinksysWAP54Gv3debug.cgiCross-SiteScripting
链接:http://www.securityfocus.com/archive/1/archive/1/511952/100/0/threaded