bugtraq - EDIMAX AR-6004 Full Rate ADSL Router Cross Site Scripting Vulnerabillity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004401c3d4a9$1e82dc80$0b3016ac@fucku>
Date: Wed, 7 Jan 2004 01:02:12 +0200
From: "Rafel Ivgi" <theinsider@....net.il>
To: <bugtraq@...urityfocus.com>
Subject: EDIMAX AR-6004 Full Rate ADSL Router Cross Site Scripting Vulnerabillity

#######################################################################

Device:            EDIMAX AR-6004 Full Rate ADSL Router Integrated 4 port
Switch
Software:         The Router's Server
Vendor:           http://www.edimax.com.tw/
Versions:         AR-6004
Platforms:       Windows
Bug:               Cross Site Scripting Vulnerabillity + Remote Compromise
Risk:               Medium
Exploitation:    Remote with browser
Date:               6 Jan 2004
Author:            Rafel Ivgi, The-Insider
e-mail:             the_insider@...l.com
web:                http://theinsider.deep-ice.com

#######################################################################

1) Introduction
2) Bug
3) The Code

#######################################################################

===============
1) Introduction
===============

EDIMAX AR-6004 Full Rate ADSL Router Is a great routing device. It includes
4 port Switch.
Device Details: http://www.edimax.com.tw/html/english/products/AR-6004.htm

#######################################################################

======
2) Bug
======

When a connection is established with the webserver it requires
authentification.
First of all there is a default username and password admin:1234 which is no
bug,
But the user and pass are *presented to the user connecting as the default
logon text*,
This is a default configuration which is a gate for trouble. In addition
when someone
gets inside the router and goes to the config area the dial up username and
password
can be easily stolen, not to mention the risk of this text-form passwords
being sniffed from
the network.

The Vulnerabillity is mainly  Cross Site Scripting. If an attacker will
request the following
url from the server http://<host>/<script>alert('XSS')</script>, when the
connection is
established with the webserver it requires authentification, if cancel is
pressed
 XSS appears and the server allows an attacker to inject & execute scripts.

#######################################################################

===========
3) The Code
===========

http://<host>/<script>alert('XSS')</script>

#######################################################################

---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com

"Things that are unlikeable, are NOT impossible."