netgear-xss.txt

`-----------------------------  
|| WWW.SMASH-THE-STACK.NET ||  
-----------------------------  
  
|| ADVISORY: NETGEAR SSL312 XSS VULNERABILITY  
  
_____________________  
|| 0x00: ABOUT ME  
|| 0x01: DATELINE  
|| 0x02: INFORMATION  
|| 0x03: EXPLOITATION  
|| 0x04: RISK LEVEL  
____________________________________________________________  
____________________________________________________________  
  
_________________  
|| 0x00: ABOUT ME  
  
Author: SkyOut  
Date: October 2007  
Contact: skyout[-at-]smash-the-stack[-dot-]net  
Website: www.smash-the-stack.net  
  
_________________  
|| 0x01: DATELINE  
  
2007-10-08: Bug found  
2007-10-09: Phone call with Netgear Germany  
2007-10-09: Email with notification sent to Netgear Germany  
2007-10-12: Still no reaction from Netgear Germany  
2007-10-13: Advisory released  
  
____________________  
|| 0x02: INFORMATION  
  
In the product "Netgear SSL312 PROSAFE SSL VPN-Concentrator 25",  
which is a VPN router for smaller to medium business companies and  
priced about 400 Euro, a bug occurs in the login page due to the  
fact of an unfiltered variable. It is possible to execute JavaScript  
code on the webinterface. It may be possible, that other products  
of this series are vulnerable to this bug, too (not tested!).  
  
_____________________  
|| 0x03: EXPLOITATION  
  
To exploit this bug no exploit is needed, all can be done trough  
the webinterface of the router in five simple steps:  
  
STEP 1:  
Go to the webinterface of the router, located at "/cgi-bin/welcome"  
by default.  
  
STEP 2:  
Wihout giving any further parameters click LOGIN.  
  
STEP 3:  
An error page will occurr with a variable (default is "err") in the  
URL. Example: "/cgi-bin/welcome/XYZ?err="  
  
STEP 4:  
Manipulate the URL and put your script code into the variable.  
Demo: "/cgi-bin/welcome/XYZ?err=<script>alert('XSS');</script>"  
  
STEP 5:  
Click ENTER and the demo popup will show up. The script code has been  
successfully executed.  
  
___________________  
|| 0x04: RISK LEVEL  
  
I would consider this a smaller bug, that can only be used in very  
specific situations. A successfull exploitation of this bug could  
lead to Session Hijacking.  
  
<!> Happy Hacking <!>  
  
____________________________________________________________  
____________________________________________________________  
  
THE END  
  
`