V-SOL GPON/EPON OLT Platform 2.03 Link Manipulation - CXSecurity.com

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1761085 漏洞类型
发布时间 2019-09-30 更新时间 2019-09-30
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019090193
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
V-SOL GPON/EPON OLT Platform v2.03 Link Manipulation Vulnerability


Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd.
Product web page: https://www.vsolcn.com
Affected version: V2.03.62R_IPv6
                  V2.03.54R
                  V2.03.52R
                  V2.03.49
                  V2.03.47
                  V2.03.40
                  V2.03.26
                  V2.03.24
                  V1.8.6
                  V1.4

Summary: GPON is currently the leading FTTH standard in broadband access
technology being widely deployed by service providers around the world.
GPON/EPON OLT products are 1U height 19 inch rack mount products. The
features of the OLT are small, convenient, flexible, easy to deploy, high
performance. It is appropriate to be deployed in compact room environment.
The OLTs can be used for 'Triple-Play', VPN, IP Camera, Enterprise LAN and
ICT applications.

Desc: Input passed via the 'parent' GET parameter in 'bindProfile.html' script
is not properly verified before being used to redirect users. This can be
exploited to redirect a logged-in user to an arbitrary website e.g. when a
user clicks a specially crafted link to the affected script hosted on a trusted
domain.

Tested on: GoAhead-Webs


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5535
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5535.php

25.09.2019

--


CSRF URL Redirect request:

GET /action/bindProfile.html?parent=https://zeroscience.mk/index
Host: 192.168.8.200


Response: 

HTTP/1.1 200 OK
Location: https://zeroscience.mk/index.html?select=0