lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 7 Jan 2004 01:02:12 +0200
From: "Rafel Ivgi" <theinsider@....net.il>
To: <bugtraq@...urityfocus.com>
Subject: EDIMAX AR-6004 Full Rate ADSL Router Cross Site Scripting Vulnerabillity


#######################################################################

Device:            EDIMAX AR-6004 Full Rate ADSL Router Integrated 4 port
Switch
Software:         The Router's Server
Vendor:           http://www.edimax.com.tw/
Versions:         AR-6004
Platforms:       Windows
Bug:               Cross Site Scripting Vulnerabillity + Remote Compromise
Risk:               Medium
Exploitation:    Remote with browser
Date:               6 Jan 2004
Author:            Rafel Ivgi, The-Insider
e-mail:             the_insider@...l.com
web:                http://theinsider.deep-ice.com

#######################################################################

1) Introduction
2) Bug
3) The Code

#######################################################################

===============
1) Introduction
===============

EDIMAX AR-6004 Full Rate ADSL Router Is a great routing device. It includes
4 port Switch.
Device Details: http://www.edimax.com.tw/html/english/products/AR-6004.htm

#######################################################################

======
2) Bug
======

When a connection is established with the webserver it requires
authentification.
First of all there is a default username and password admin:1234 which is no
bug,
But the user and pass are *presented to the user connecting as the default
logon text*,
This is a default configuration which is a gate for trouble. In addition
when someone
gets inside the router and goes to the config area the dial up username and
password
can be easily stolen, not to mention the risk of this text-form passwords
being sniffed from
the network.

The Vulnerabillity is mainly  Cross Site Scripting. If an attacker will
request the following
url from the server http://<host>/<script>alert('XSS')</script>, when the
connection is
established with the webserver it requires authentification, if cancel is
pressed
 XSS appears and the server allows an attacker to inject & execute scripts.

#######################################################################

===========
3) The Code
===========

http://<host>/<script>alert('XSS')</script>

#######################################################################

---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com

"Things that are unlikeable, are NOT impossible."



Powered by blists - more mailing lists