Alice (Telefonica Germany) Modem 1111 DoS + XSS

2011-07-18T00:00:00
ID SECURITYVULNS:DOC:26656
Type securityvulns
Reporter Securityvulns
Modified 2011-07-18T00:00:00

Description

German ISP 'Alice' has been shipping custom embedded devices (DSL modems/routers etc.) for the past few years. Their first self-branded DSL modem, Alice Modem 1111, using firmware version 4.19, is prone to at least the following two security vulnerabilities (after it has passed initial configuration).

  1. Denial of Service (DoS) via HTTP GET: http://alice.box/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99

After accessing this URL, the modem fails to accept any additional connections via any of the protocols it supports (incl. telnet). The web interface is only available from within the LAN, but an insecure redirect from the Internet would work to exploit this.

  1. Cross Site Scripting (XSS) http://alice.box/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3=

Accessing this URL via HTTP GET or POST makes the router set a port forwarding rule whose label ('rulename') contains javascript code. Due to lack of (server side) input validation, this code is run in the web browser. Once set, additional requests to the listing of port forwarding rules at http://alice.box/webconfig/portforwarding/main_portforwarding.html will cause the javascript code to be executed, and may trigger cross site scripting.

Telefonica Germany, previously Hansenet Telekommunication, has been notified about these issues multiple times starting 2011-03-01. One day later, I received a response indicating this model is no longer being shipped and that there will be no fix for it. Additional attempts to get in touch, explaining that this does not help any of the clients who are already using this device, were not responded to (other than by confirming receipt).

The same ISP has their 'secure' client area accessed via https://www.alice-dsl.de which has obvious implementation flaws: https://www.ssllabs.com/ssldb/analyze.html?d=www.alice-dsl.de (which I notified the company about on 2010-12-20)

Moritz Naumann

Naumann IT Security Consulting Samariterstr. 16 10247 Berlin Germany