Thomson Speed Touch 500 Series Web Interface Input Validation Hole Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1015688 |
|
SecurityTracker URL: http://securitytracker.com/id/1015688
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Feb 28 2006
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): SpeedTouch 500 Series; 5.3.2.6.0
|
Description:
A vulnerability was reported in the Thomson Speed Touch 500 series modems. A remote user can conduct cross-site scripting attacks.
The web interface does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by an authenticated target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the device and will run in the security context of the device. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.
A demonstration exploit URL is provided:
http://[target]/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code here]
Preben Nylokken discovered this vulnerability.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.thomson.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: 26 Feb 2006 12:53:12 -0000
Subject: Thomson SpeedTouch 500 modems vulnerable to XSS
|
TITLE:
Thomson SpeedTouch 500 series vulnerable to XSS
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
SOFTWARE:
SpeedTouch 5.3.2.6.0
DESCRIPTION:
There consists a vulnerability in the SpeedTouch modems, which
can be exploited by malicious people to conduct cross-site scripting
attacks, and make a counseled user
Input passed to the LocalNetwork page isn't properly sanitized before being
returned to the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected site.
Such code can also be added through a proxy, because user validation
is only done by JavaScript. If a user is made with injected scripting code
this user will become un-delete able if the code is crafted correctly.
PoC #1 - XSS
http://[host]/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code here]
PoC #2 - Stealthy user (through proxy)
0=10&1=usrAccApply&34=NewUser&36=1&33=test&31=[code here]
SOLUTION:
Check vendor's site for firmware upgrade.
As of this writing, none is available
PROVIDED AND DISCOVERED BY:
Preben Nyløkken
|
|
