SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Router/Bridge/Hub)  >   Edimax Router Vendors:   EDIMAX Technology Co.
Edimax AR-6004 Router Input Validation Flaw Permits Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1008643
SecurityTracker URL:  http://securitytracker.com/id/1008643
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 7 2004
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information

Version(s): AR-6004
Description:   An input validation vulnerability was reported in the Edimax AR-6004 router. A remote user can conduct cross-site scripting attacks.

Rafel Ivgi (The-Insider) reported that the router's administrative interface does not filter HTML code from user-supplied input before displaying the user-supplied information. A remote user can create a specially crafted URL that, when loaded by a target administrator, will display an authentication dialog box. If the target user presses 'cancel', arbitrary scripting code will be executed by the target user's browser. The code will originate from the router and will run in the security context of that device. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.

A demonstration exploit URL is provided:

http://[target]/<script>alert('XSS')</script>

It is also reported that the system uses a common default username and password (admin:1234). Furthermore, the username and password is reportedly displayed to a connecting user as the default login text.

Impact:   A remote user can access the target administrator's cookies (including authentication cookies), if any, associated with the device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.edimax.com.tw/ (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  EDIMAX AR-6004 Full Rate ADSL Router Cross Site Scripting Vulnerabillity


#######################################################################

Device:            EDIMAX AR-6004 Full Rate ADSL Router Integrated 4 port
Switch
Software:         The Router's Server
Vendor:           http://www.edimax.com.tw/
Versions:         AR-6004
Platforms:       Windows
Bug:               Cross Site Scripting Vulnerabillity + Remote Compromise
Risk:               Medium
Exploitation:    Remote with browser
Date:               6 Jan 2004
Author:            Rafel Ivgi, The-Insider
e-mail:             the_insider@mail.com
web:                http://theinsider.deep-ice.com

#######################################################################

1) Introduction
2) Bug
3) The Code

#######################################################################

===============
1) Introduction
===============

EDIMAX AR-6004 Full Rate ADSL Router Is a great routing device. It includes
4 port Switch.
Device Details: http://www.edimax.com.tw/html/english/products/AR-6004.htm

#######################################################################

======
2) Bug
======

When a connection is established with the webserver it requires
authentification.
First of all there is a default username and password admin:1234 which is no
bug,
But the user and pass are *presented to the user connecting as the default
logon text*,
This is a default configuration which is a gate for trouble. In addition
when someone
gets inside the router and goes to the config area the dial up username and
password
can be easily stolen, not to mention the risk of this text-form passwords
being sniffed from
the network.

The Vulnerabillity is mainly  Cross Site Scripting. If an attacker will
request the following
url from the server http://<host>/<script>alert('XSS')</script>, when the
connection is
established with the webserver it requires authentification, if cancel is
pressed
 XSS appears and the server allows an attacker to inject & execute scripts.

#######################################################################

===========
3) The Code
===========

http://<host>/<script>alert('XSS')</script>

#######################################################################

---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com

"Things that are unlikeable, are NOT impossible."

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC