NETGEAR FVS318 Lets Remote Users Bypass the URL Filter and Conduct Cross-Site Scripting Attacks Against Administrators
SecurityTracker Alert ID: 1012913|
SecurityTracker URL: http://securitytracker.com/id/1012913
(Links to External Site)
Date: Jan 17 2005
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Host/resource access via network, Modification of user information|
Exploit Included: Yes |
Version(s): 2.4; possibly other versions|
Paul Kurczaba from SecuriNews Research reported some vulnerabilities in the NETGEAR FVS318 router. A remote user can bypass the URL filter. A remote user can also conduct cross-site scripting attacks.|
The Security Log does not properly filter HTML code from user-supplied URLs when logging blocked URLs. A remote user can supply a specially crafted URL containing a string that will be blocked by the router and also containing scripting code. Then, when the target administrator views the Security Log, arbitrary scripting code will be executed by the target administrator's browser. The code will originate from the router running the vulnerable software and will run in the security context of that router. As a result, the code will be able to access the target administrator's cookies (including authentication cookies), if any, associated with the router, access data recently submitted by the target administrator via web form to the router, or take actions on the router acting as the target administrator.
A demonstration exploit URL is provided [where 'somefile.exe' or '.exe' is a string to be blocked by the URL filter]:
A remote user can use Hex encoded characters in a URL to bypass the URL filter.
The original advisory is available at:
A remote user can access the target administrator's cookies (including authentication cookies), if any, associated with the router running the vulnerable software, access data recently submitted by the target administrator via web form to the router, or take actions on the router acting as the target administrator.|
No solution was available at the time of this entry.|
Vendor URL: www.netgear.com/ (Links to External Site)
Access control error, Input validation error|
Source Message Contents
Subject: Multiple Vulnerabilities in Netgear FVS318 Router|
Multiple Vulnerabilities in Netgear FVS318 Router
The Netgear FVS318 is an easy to use, firewall/router designed for home users and small
businesses. SecuriNews Research has found 2 vulnerabilities in the router.
2.4, possibly others
1) By using HEX encoded characters, it is possible to bypass the URL filter. For
example, if the router administrator blocks the phrase ".exe"; a user can encode one or
more characters in the URL phrase to bypass the filter. If we encode the 'x' in ".exe",
the new phrase ".e%78e" will bypass the filter.
2) The content filter/log viewer contains a Cross Site Scripting vulnerability. When a
user tries to access a blocked URL phrase, it is logged in the Security Log. If a user
by the admin's browser when the security log is viewed.
Proof of Concept:
1) Example above.
2) If the router administrator has blocked the URL phrase ".exe", a user can inject
security log is placed in a text area.
January 14, 2005