Информационная безопасность
[RU] switch to English


Дополнительная информация

  Уязвимости безопасности в ADSL-маршрутизаторе ZTE Callisto 821+

  CSRF vulnerabilities in Callisto 821+R3 ADSL Router

  Vulnerabilities in Callisto 821+R3 ADSL Router

  Vulnerabilities in Callisto 821+R3 ADSL Router

  Multiple CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

From:MustLive <mustlive_(at)_websecurity.com.ua>
Date:1 августа 2011 г.
Subject:Multiple DoS, CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

Hello 3APA3A!

This is the last advisory in which I'll warn you about new multiple
security vulnerabilities in ADSL modem Callisto 821+ (SI2000
Callisto821+ Router). This time I will tell you about Security
section of control panel, which is full of vulnerabilities.

These are Denial of Service, Cross-Site Request Forgery and
Cross-Site Scripting vulnerabilities. In April I've already drew
attention of Ukrtelecom's representative (and this modem was bough at
Ukrtelecom) about multiple vulnerabilities in this model of Callisto
modems (and other models also could be affected).

These attacks should be conducted on modem owner, which is logged
into control panel. Taking into account that it's unlikely to catch
him in this state, then it's possible to use before-mentioned
vulnerabilities (http://websecurity.com.ua/5161/) for conducting of
remote login (for logining him into control panel). After that it's
possible to conduct CSRF or XSS attack.

DoS (WASC-10):

Almost all functionality of control panel (that one, which works via
POST) is vulnerable to DoS attacks. It's partial DoS vulnerability,
which leads to freezing of modem on 75 seconds (at that freezing only
control panel and connection with Internet via router is working).
The freezing has place at sending of special request, and later every
time at any operations of writing (adding or changing of any
settings), deleting (logs or settings), and in some cases even at
entering in section of control panel. I.e. it's persistent partial
DoS.

Sending of empty or incorrect value in parameter EmWeb_ns:vim:3 (via
GET/POST), and sometimes in some other parameters, and also at
setting in special way the names of parameters, as at XSS attacks via
the names of parameters, which I wrote about earlier
(http://websecurity.com.ua/5277/), lead to freezing of modem.

http://192.168.1.1/configuration/edit-form.html/edit?EmWeb_ns:vim:3=

It's impossible to work in control panel in such conditions. It's
possible to solve it only by restarting of the modem.

CSRF (WASC-09):

In section Security Interface Configuration
(http://192.168.1.1/configuration/firewall.html) via CSRF it's
possible to change Security State - to turn on/off Security, Firewall
and IDS (and at enabled Firewall it's possible to change Security
Level), and also it's possible to turn on/off NAT for interfaces.

In section Security: Add Interface
(http://192.168.1.1/configuration/fw_addInterface.html) via CSRF it's
possible to add interfaces.

This vulnerability allows to delete Security Interfaces. For
example, default interface (iplan):

http://192.168.1.1/configuration/fw_deleteInterface.
html/fwDeleteInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffire
wall.html&EmWeb_ns%3Avim%3A7.ImFireWall.ImFwInterfaces.
iplan=ImFireWall.ImFwInterfaces.iplan

If NAT is enabled for interface, then it's possible to change its
settings. Via CSRF to add addresses in section Add Global Address
Pool
(http://192.168.1.1/configuration/fw_addAddressPool.html?ImFireWall.ImFwInter
faces.ipmn
)
and to add mappings in section Add Reserved Mapping
(http://192.168.1.1/configuration/fw_addReservedMapping.html?ImFireWall.ImFwI
nterfaces.ipmn
).

In section Security Policy Configuration in subsections Firewall
Port Filters
(http://192.168.1.1/configuration/fw_filter.html?ImFireWall.ImFwPolicies.ext-
int
)
and Configure Validators
(http://192.168.1.1/configuration/fw_validators.html?ImFireWall.ImFwPolicies.
ext-int
)
via CSRF it's possible to add and delete filters.

In section Security Trigger Configuration
(http://192.168.1.1/configuration/fw_trigger.html) via CSRF it's
possible to add and delete triggers.

In section Firewall Configure Intrusion Detection
(http://192.168.1.1/configuration/fw_ids.html) via CSRF it's possible
to change settings of IDS.

In section Security Logging Configuration
(http://192.168.1.1/configuration/fw_logging.html) via CSRF it's
possible to turn on/off logging and change its settings.

XSS (WASC-08):

There are many persistent XSS vulnerabilities in all above-mentioned
sections.

http://192.168.1.1/configuration/fw_addInterface.
html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewal
l.html&EmWeb_ns%3Avim%3A10.
_interface=%3Cscript%3Ealert(document.
cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.
html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewal
l.html&EmWeb_ns%3Avim%3A10.
_interface=ImFwInterface&EmWeb_ns%3Avim%3A2.
_interface%3AInterfaceName=%3Cscript%3Ealert(document.
cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.
html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewal
l.html&EmWeb_ns%3Avim%3A10.
_interface=ImFwInterface&EmWeb_ns%3Avim%3A2.
_interface%3AInterfaceType=%3Cscript%3Ealert(document.
cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.
html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewal
l.html&EmWeb_ns%3Avim%3A10.
_interface=ImFwInterface&EmWeb_ns%3Avim%3A2.
_interface%3AInterfaceName=ipmn&EmWeb_ns%3Avim%3A13.
_interface=InterfaceName%2CInterfaceType%3A%3Cscript%3Ealert(
document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_deleteInterface.
html/fwDeleteInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffire
wall.html&EmWeb_ns%3Avim%3A7.%3Cscript%3Ealert(document.
cookie)%3C/script%3E=

And also in section Security Interface Configuration itself and in
sections Add Global Address Pool, Add Reserved Mapping, in
subsections Firewall Port Filters and Configure Validators of section
Security Policy Configuration, in sections Security Trigger
Configuration, Firewall Configure Intrusion Detection and Security
Logging Configuration there are persistent XSS vulnerabilities in all
text fields and some hidden fields.

And also attacks via the names of parameters are possible (when XSS
code is setting in the name of parameter), which I wrote about
earlier.

In this case the code will be executed immediately, and also at
visiting of pages http://192.168.1.1/system/events.html and
http://192.168.1.1/shared/event_log_selection.html.

Vulnerable is the next model: SI2000 Callisto821+ Router: X7821
Annex A v1.0.0.0 / Argon 4x1 CSP v1.0 (ISOS 9.0) [4.3.4-5.1]. This
model with other firmware and also other models of Callisto also must
be vulnerable.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5302/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород