Multiple DoS, CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

2011-08-01T00:00:00
ID SECURITYVULNS:DOC:26721
Type securityvulns
Reporter Securityvulns
Modified 2011-08-01T00:00:00

Description

Hello 3APA3A!

This is the last advisory in which I'll warn you about new multiple security vulnerabilities in ADSL modem Callisto 821+ (SI2000 Callisto821+ Router). This time I will tell you about Security section of control panel, which is full of vulnerabilities.

These are Denial of Service, Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. In April I've already drew attention of Ukrtelecom's representative (and this modem was bough at Ukrtelecom) about multiple vulnerabilities in this model of Callisto modems (and other models also could be affected).

These attacks should be conducted on modem owner, which is logged into control panel. Taking into account that it's unlikely to catch him in this state, then it's possible to use before-mentioned vulnerabilities (http://websecurity.com.ua/5161/) for conducting of remote login (for logining him into control panel). After that it's possible to conduct CSRF or XSS attack.

DoS (WASC-10):

Almost all functionality of control panel (that one, which works via POST) is vulnerable to DoS attacks. It's partial DoS vulnerability, which leads to freezing of modem on 75 seconds (at that freezing only control panel and connection with Internet via router is working). The freezing has place at sending of special request, and later every time at any operations of writing (adding or changing of any settings), deleting (logs or settings), and in some cases even at entering in section of control panel. I.e. it's persistent partial DoS.

Sending of empty or incorrect value in parameter EmWeb_ns:vim:3 (via GET/POST), and sometimes in some other parameters, and also at setting in special way the names of parameters, as at XSS attacks via the names of parameters, which I wrote about earlier (http://websecurity.com.ua/5277/), lead to freezing of modem.

http://192.168.1.1/configuration/edit-form.html/edit?EmWeb_ns:vim:3=

It's impossible to work in control panel in such conditions. It's possible to solve it only by restarting of the modem.

CSRF (WASC-09):

In section Security Interface Configuration (http://192.168.1.1/configuration/firewall.html) via CSRF it's possible to change Security State - to turn on/off Security, Firewall and IDS (and at enabled Firewall it's possible to change Security Level), and also it's possible to turn on/off NAT for interfaces.

In section Security: Add Interface (http://192.168.1.1/configuration/fw_addInterface.html) via CSRF it's possible to add interfaces.

This vulnerability allows to delete Security Interfaces. For example, default interface (iplan):

http://192.168.1.1/configuration/fw_deleteInterface.html/fwDeleteInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A7.ImFireWall.ImFwInterfaces.iplan=ImFireWall.ImFwInterfaces.iplan

If NAT is enabled for interface, then it's possible to change its settings. Via CSRF to add addresses in section Add Global Address Pool (http://192.168.1.1/configuration/fw_addAddressPool.html?ImFireWall.ImFwInterfaces.ipmn) and to add mappings in section Add Reserved Mapping (http://192.168.1.1/configuration/fw_addReservedMapping.html?ImFireWall.ImFwInterfaces.ipmn).

In section Security Policy Configuration in subsections Firewall Port Filters (http://192.168.1.1/configuration/fw_filter.html?ImFireWall.ImFwPolicies.ext-int) and Configure Validators (http://192.168.1.1/configuration/fw_validators.html?ImFireWall.ImFwPolicies.ext-int) via CSRF it's possible to add and delete filters.

In section Security Trigger Configuration (http://192.168.1.1/configuration/fw_trigger.html) via CSRF it's possible to add and delete triggers.

In section Firewall Configure Intrusion Detection (http://192.168.1.1/configuration/fw_ids.html) via CSRF it's possible to change settings of IDS.

In section Security Logging Configuration (http://192.168.1.1/configuration/fw_logging.html) via CSRF it's possible to turn on/off logging and change its settings.

XSS (WASC-08):

There are many persistent XSS vulnerabilities in all above-mentioned sections.

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=ImFwInterface&EmWeb_ns%3Avim%3A2._interface%3AInterfaceName=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=ImFwInterface&EmWeb_ns%3Avim%3A2._interface%3AInterfaceType=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=ImFwInterface&EmWeb_ns%3Avim%3A2._interface%3AInterfaceName=ipmn&EmWeb_ns%3Avim%3A13._interface=InterfaceName%2CInterfaceType%3A%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_deleteInterface.html/fwDeleteInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A7.%3Cscript%3Ealert(document.cookie)%3C/script%3E=

And also in section Security Interface Configuration itself and in sections Add Global Address Pool, Add Reserved Mapping, in subsections Firewall Port Filters and Configure Validators of section Security Policy Configuration, in sections Security Trigger Configuration, Firewall Configure Intrusion Detection and Security Logging Configuration there are persistent XSS vulnerabilities in all text fields and some hidden fields.

And also attacks via the names of parameters are possible (when XSS code is setting in the name of parameter), which I wrote about earlier.

In this case the code will be executed immediately, and also at visiting of pages http://192.168.1.1/system/events.html and http://192.168.1.1/shared/event_log_selection.html.

Vulnerable is the next model: SI2000 Callisto821+ Router: X7821 Annex A v1.0.0.0 / Argon 4x1 CSP v1.0 (ISOS 9.0) [4.3.4-5.1]. This model with other firmware and also other models of Callisto also must be vulnerable.

I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/5302/).

Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua