Thomson SpeedTouch 500 modems vulnerable to XSS
TITLE:
Thomson SpeedTouch 500 series vulnerable to XSS
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
SOFTWARE:
SpeedTouch 5.3.2.6.0
DESCRIPTION:
There consists a vulnerability in the SpeedTouch modems, which
can be exploited by malicious people to conduct cross-site scripting
attacks, and make a counseled user
Input passed to the LocalNetwork page isn't properly sanitized before being
returned to the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected site.
Such code can also be added through a proxy, because user validation
is only done by JavaScript. If a user is made with injected scripting code
this user will become un-delete able if the code is crafted correctly.
PoC #1 - XSS
http://[host]/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code here]
PoC #2 - Stealthy user (through proxy)
0=10&1=usrAccApply&34=NewUser&36=1&33=test&31=[code here]
SOLUTION:
Check vendor's site for firmware upgrade.
As of this writing, none is available
PROVIDED AND DISCOVERED BY:
Preben Nyløkken