lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 23 Jan 2016 20:59:00 -0000
From: graphx@...aint.org
To: fulldisclosure@...lists.org
Subject: [FD] ZyXel WAP3205 V1 Multiple Persistent and Reflected XSS


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

#Vendor: ZyXel WAP3205 - version 1  (Product is EOL  and no patch
forthcoming)
#Firmware version: V1.00(BFR.6) - V1.00(BFR.8)C0
#Exploit Author: Nicholas Lehman @GraphX
#Vulnerability: Multiple persistent and reflected XSS vulnerabilities

Description:
Multiple persistent XSS Vulnerabilities have been discovered in the ZyXel
WAP3205 (version 1) wireless access point.  These vulnerabilities could
allow and  authenticated attacker to insert persistent malicious code on
several pages and using several different fields.  The WAP is End-Of-Life
according to the vendor and will not be issuing a patch for these
vulnerabilities.

Proof of Concept:
The first vulnerability discovered pertained to the inputs found on


- - -http://<ROUTER_IP>/local/advance/main_maintenance_frame.html
the domain_name and system_name inputs are vulnerable to reflected
cross-site scripting and there does not appear to be any validation or
sanitation of those inputs. the admin_inactivity_time input is vulnerable
to persistent XSS with the following code being used:
admin_inactivity_timer=0"><script>alert(document.cookie)</script><input

- - -The date and time tab is also vulnerable to persistent cross site
scripting.  The following inputs allow for malicious code to be stored and
executed:
NTPServerIP
servertype
timedatatype

3. Solution:
ZyXel was informed of the vulnerability, but since the router is end of
life,  a patch will not be released.
Upgrade to a supported WAP
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWo8HaAAoJEGoTpzhfiAPxZFYP/iMGT7oGqHxLtw5rGVk0t5my
ZxKD/ho84OhtHP6d1d4mVcKOmVGPMRLCR7V62m6G9iluzTx08uhAooXzdGPfua9I
WXY+bIyj/3w5ydYJRd6gfR3/BwBHQKiMb06Iwsm2KivZNLYTFZ1mThXcn/dpgopL
BRjLxpVaMOAVEaVgHEcm0B59uaIFT2jBSHfi3MZMYSlkoEGTCs+UaJ3qxMbmxYC9
06Zg8+pQs17AOdaBhSRb/vfeBRuLjbSsNZwI2XrDd5rj6+J3z34VasAnStgcd/uV
5cSIN7AAlfi3sg7BE+3hUZxK8p0KL2vKsm1/FOzAXs9H5/x51vLeJ0zbS4f57wIC
x8lfkEu5GnK2jD2f0IeHrtnesXnIsBAB5THYxrqIfXJI0QpJZk0Dt3NL/uy2x4II
gX8mnqJdci8o58oB4EG3RoYjKNpbbKGmF2JO1Gvgu9COmxMiYhTi9/HUW+SUizne
zDjSeYLRn+VwuG4b77Rv+DH32ue93ujuIIMI+0zRzbpVo0kTr8P772LDn/Ypc5PP
QtDC9A3OHqMOlrURgEEOU4uoB7rEH/aFqmuqEmdjdAVqRJ9xHINtChCIuNCFR9S1
wGluQ2HQ58eOZZK2GCUep57bgaFHSzm5mi0uHd27h6J40wVTiErZfJM5SW8z/rI1
JVy7N1+3MESCr8pW/Cgo
=sI1p
-----END PGP SIGNATURE-----




_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists