exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

TP-Link TL-SG108E XSS / Weak Access Control

TP-Link TL-SG108E XSS / Weak Access Control
Posted Dec 20, 2017
Authored by James McLean

TP-Link TL-SG108E with firmware 1.0.0 Build 20160722 Rel.50167 suffers from cross site scripting and weak access control vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2017-17745, CVE-2017-17747
SHA-256 | 7330f87f7a3667cb6fa598a2593142faa0353408372b85307781681e8b6ed07f

TP-Link TL-SG108E XSS / Weak Access Control

Change Mirror Download
Overview
-------------
Three vulnerabilities have been discovered in the TP-Link TL-SG108E,
firmware 1.0.0 Build 20160722 Rel.50167:
CVE-2017-17745 - Cross Site Scripting (XSS) in system_name_set.cgi,
sysName parameter
CVE-2017-17746 - Weak access control for user authentication
CVE-2017-17747 - Weak access control for user logout

This is not an exhaustive list of vulnerabilities that may exist in
the device firmware.

Device Overview
-----------------------
>From http://www.tp-link.com.au/products/details/cat-41_TL-SG108E.html
- "The TL-SG108E 8-Port Gigabit Easy Smart switch is an ideal upgrade
from an unmanaged switch, designed for Small and Medium Business
networks that require simple network management. Network
administrators can effectively monitor traffic via Port Mirroring,
Loop Prevention and Cable Diagnostics features."

Affected Devices
-----------------------
Firmware Version: 1.0.0 Build 20160722 Rel.50167
Hardware Version: TL-SG108E 3.0

Older TL-SG108E devices may also be affected.

Disclosure Timeline
--------------------------
September 08th, 2017 - Vulnerabilities discovered after purchasing the device.
September 10th, 2017 - Contacted TP-Link via tp-link.com.au
September 12th, 2017 - TP-Link responded, requesting further information
September 12th, 2017 - Responded to TP-Link with vulnerability
specifics. Advised a 90 day disclosure timeline, with offer to
increase deadline if TP-Link wishes.
September 12th -> October 16th - Emails back and forth discussing how
to trigger the vulnerabilities.
October 16th, 2017 - TP-Link confirms XSS vulnerability
(CVE-2017-17745), advises an updated firmware will be released.
TP-Link advises two remaining vulnerabilities (CVE-2017-17746,
CVE-2017-17747) will not be fixed.
December 18th, 2017 - Applied to Mitre for CVE numbers.
December 19th, 2017 - Mitre assigned CVE-2017-17745, CVE-2017-17746,
CVE-2017-17747
December 19th, 2017 - Public disclosure.

As of this date (December 19th, 2017), no updated firmware has been
offered for testing, or released to the public.

Notes
--------
In all examples below, the TL-SG108E was configured with a LAN IP
address of 192.168.1.6.
Many thanks to Simon @ TP-Link for the prompt email responses.

CVE-2017-17745 - Stored Cross Site Scripting (XSS)
-------------------------------------------------------------------------
* Device is not validating input to the script system_name_set.cgi on
the TL-SG108E or on output to screen.
* Only the sysName variable in system_name_set.cgi was tested in this
instance. Other fields in the management web-application may have
similar problems, these were not tested.

Risks:
* In some network configurations (such as behind a NAT router, as
outlined in CVE-2017-17746) a malicious user could store XSS on the
TL-SG108E and cause the administrator of the TL-SG108E to execute
arbitrary javascript code in their browser.

Proof of Concept:
* Authenticate to the device in a browser
* Execute the following command from a terminal window: curl -vvvs -X
'GET' 'http://192.168.1.6/system_name_set.cgi?sysName=TL-SG"\]\};alert(1);</script>'
* To trigger the XSS: Browse -> System -> System Info. Alert box
containing '1' displays, indicating successful javascript execution.

Mitigation:
* Set the device password to a strong password.
* Restrict access to the device from approved administrator
workstations until an updated firmware is available.

CVE-2017-17746 - Weak access control
------------------------------------------------------
* All information regarding authenticated sessions is stored on the
TL-SG108E, no cookies are sent from the device to the client after
successful authentication.

Risks:
* Any other browser on a PC which has authenticated, is then also
treated as authenticated (Example: Login in Chrome, then open Firefox
and browse to the TL-SG108E, and the session is already authenticated)
* If the TL-SG108E is on the other side of a NAT router, ALL clients
behind the NAT are treated as authenticated.

Steps to reproduce:
* Authenticate from any PC.
* Any other browser on that system is then able to access the
web-interface without entering authentication information.
* By extension, guest VMs on that machine are then automatically authenticated.

Mitigation:
* Restrict access to the device from approved administrator
workstations until an updated firmware is available.
* Prevent any access to the web interface from devices behind a NAT router.

CVE-2017-17747 - Weak access control on Logout.htm
-------------------------------------------------------------------------
* Logout.htm can be called from any IP address, ending any
authenticated sessions on the device.

Risks:
* A denial of service condition can be triggered by calling the logout
script in a loop from any machine on the network regardless of their
authentication status, effectively making it impossible to access the
TL-SG108E management web-application.

Steps to reproduce:
* Authenticate from any PC.
* From another PC with a different IP address, access the logout page
(http://192.168.1.6/Logout.htm)
* The session on the first PC has been terminated.

Mitigation:
* Restrict access to the device from approved administrator
workstations until an updated firmware is available.

--
End disclosure.


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close