ID

VAR-201407-0318

CVE

CVE-2013-7389

TITLE

D-Link DIR-645 Router firmware cross-site scripting vulnerability

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php. D-Link DIR-645 Router (Rev. A1) Contains a cross-site scripting vulnerability.By a third party via the following parameters Web Script or HTML May be inserted. (1) parentalcontrols/bind.php of deviceid Parameters (2) info.php of RESULT Parameters (3) bsc_sms_send.php of receiver Parameters. The D-Link DIR-645 Widget function has an unexplained security vulnerability that allows a remote attacker to exploit the vulnerability to gain unauthorized access to the device. The D-Link DIR-645 is a wireless router device. D-Link DIR-645 \"post_login.xml\", \"hedwig.cgi\", \"authentication.cgi\" incorrectly filters user-submitted parameter data, allowing remote attackers to exploit exploits to submit specially crafted requests to trigger buffer overflows, allowing applications to Stop responding, causing a denial of service attack. Remote attackers can exploit these issues to execute arbitrary code in the context of the affected device or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and perform unauthorized actions. Other attacks may also be possible. D-Link DIR-645 running firmware 1.03B08 is vulnerable; other versions may also be affected. Multiple vulnerabilities on D-Link DIR-645 devices ================================================== [ADVISORY INFORMATION] Title: Multiple vulnerabilities on D-Link DIR-645 devices Discovery date: 06/03/2013 Release date: 02/08/2013 Advisory URL: http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt Credits: Roberto Paleari (roberto@greyhats.it, twitter: @rpaleari) [AFFECTED PRODUCTS] This security vulnerability affects the following products and firmware versions: * D-Link DIR-645, 1.03B08 Other products and firmware versions could also be vulnerable, but they were not checked. All of them are exploitable by remote, unauthenticated attackers. Details are outlined in the following, including some proof-of-concepts. 1. Buffer overflow on "post_login.xml" Invoking the "post_login.xml" server-side script, attackers can specify a "hash" password value that is used to authenticate the user. This hash value is eventually processed by the "/usr/sbin/widget" local binary. However, the latter copies the user-controlled hash into a statically-allocated buffer, allowing attackers to overwrite adjacent memory locations. As a proof-of-concept, the following URL allows attackers to control the return value saved on the stack (the vulnerability is triggered when executing "/usr/sbin/widget"): curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB The value of the "hash" HTTP GET parameter consists in 292 occurrences of the 'A' character, followed by four occurrences of character 'B'. In our lab setup, characters 'B' overwrite the saved program counter (%ra). 2. Buffer overflow on "hedwig.cgi" Another buffer overflow affects the "hedwig.cgi" CGI script. Unauthenticated remote attackers can invoke this CGI with an overly-long cookie value that can overflow a program buffer and overwrite the saved program address. Proof-of-concept: curl -b uid=$(perl -e 'print "A"x1400;') -d 'test' http://<target ip>/hedwig.cgi 3. Buffer overflow on "authentication.cgi" The third buffer overflow vulnerability affects the "authentication.cgi" CGI script. This time the issue affects the HTTP POST paramter named "password". Again, this vulnerability can be abused to achieve remote code execution. As for all the previous issues, no authentication is required. Proof-of-concept: curl -b uid=test -d $(perl -e 'print "uid=test&password=asd" . "A"x2024;') http://<target ip>/authentication.cgi 4. Cross-site scripting on "bind.php" Proof-of-concept: curl "http://<target ip>/parentalcontrols/bind.php?deviceid=test'\"/><script>alert(1)</script><" 5. Cross-site scripting on "info.php" Proof-of-concept: curl "http://<target ip>/info.php?RESULT=testme\", msgArray); alert(1); //" 6. Cross-site scripting on "bsc_sms_send.php" Proof-of-concept: curl "http://<target ip>/bsc_sms_send.php?receiver=testme\"/><script>alert(1);</script><div" [REMEDIATION] D-Link has released an updated firmware version (1.04) that addresses this issue. The firmware is already available on D-Link web site, at the following URL: http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000 [DISCLAIMER] The author is not responsible for the misuse of the information provided in this security advisory. The advisory is a service to the professional security community. There are NO WARRANTIES with regard to this information. Any application or distribution of this information constitutes acceptance AS IS, at the user's own risk. This information is subject to change without notice

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

XSS

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Roberto Paleari

SOURCES

LAST UPDATE DATE

2024-11-23T22:23:04.883000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE