Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
NETGEAR FVS318 Lets Remote Users Bypass the URL Filter and Conduct Cross-Site Scripting Attacks Against Administrators
|
|
SecurityTracker Alert ID: 1012913 |
|
SecurityTracker URL: http://securitytracker.com/id/1012913
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 17 2005
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Host/resource access via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 2.4; possibly other versions
|
Description:
Paul Kurczaba from SecuriNews Research reported some vulnerabilities in the NETGEAR FVS318 router. A remote user can bypass the URL filter. A remote user can also conduct cross-site scripting attacks.
The Security Log does not properly filter HTML code from user-supplied URLs when logging blocked URLs. A remote user can supply a specially crafted URL containing a string that will be blocked by the router and also containing scripting code. Then, when the target administrator views the Security Log, arbitrary scripting code will be executed by the target administrator's browser. The code will originate from the router running the vulnerable software and will run in the security context of that router. As a result, the code will be able to access the target administrator's cookies (including authentication cookies), if any, associated with the router, access data recently submitted by the target administrator via web form to the router, or take actions on the router acting as the target administrator.
A demonstration exploit URL is provided [where 'somefile.exe' or '.exe' is a string to be blocked by the URL filter]:
http://[target]/somefile.exe</textarea><script>alert('XSS')</script>
A remote user can use Hex encoded characters in a URL to bypass the URL filter.
The original advisory is available at:
http://www.securinews.com/vuln.htm?vulnid=103
|
Impact:
A remote user can access the target administrator's cookies (including authentication cookies), if any, associated with the router running the vulnerable software, access data recently submitted by the target administrator via web form to the router, or take actions on the router acting as the target administrator.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.netgear.com/ (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 17 Jan 2005 01:11:15 -0500
Subject: Multiple Vulnerabilities in Netgear FVS318 Router
|
Multiple Vulnerabilities in Netgear FVS318 Router
http://www.securinews.com/vuln.htm?vulnid=103
-------------------------------------------------
Overview:
The Netgear FVS318 is an easy to use, firewall/router designed for home users and small
businesses. SecuriNews Research has found 2 vulnerabilities in the router.
Vendor:
Netgear (http://www.netgear.com)
Affected Systems/Configuration:
2.4, possibly others
Vulnerabilities/Exploits:
1) By using HEX encoded characters, it is possible to bypass the URL filter. For
example, if the router administrator blocks the phrase ".exe"; a user can encode one or
more characters in the URL phrase to bypass the filter. If we encode the 'x' in ".exe",
the new phrase ".e%78e" will bypass the filter.
2) The content filter/log viewer contains a Cross Site Scripting vulnerability. When a
user tries to access a blocked URL phrase, it is logged in the Security Log. If a user
were to inject JavaScript into a blocked URL phrase, the JavaScript would be executed
by the admin's browser when the security log is viewed.
Proof of Concept:
1) Example above.
2) If the router administrator has blocked the URL phrase ".exe", a user can inject
JavaScript as follows:
http://www.example.com/somefile.exe</textarea><script>alert('XSS')</script>
Note: The string "</textarea>" must be added before the injected JavaScript, as the
security log is placed in a text area.
Workaround:
None.
Date Discovered:
January 14, 2005
Severity:
Low-Medium
Credit:
SecuriNews Research
http://www.securinews.com/
|
|
Go to the Top of This SecurityTracker Archive Page
|
