SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Device (Router/Bridge/Hub)  >   NETGEAR Router Vendors:   NETGEAR
NETGEAR FVS318 Lets Remote Users Bypass the URL Filter and Conduct Cross-Site Scripting Attacks Against Administrators
SecurityTracker Alert ID:  1012913
SecurityTracker URL:  http://securitytracker.com/id/1012913
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 17 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Host/resource access via network, Modification of user information
Exploit Included:  Yes  
Version(s): 2.4; possibly other versions
Description:   Paul Kurczaba from SecuriNews Research reported some vulnerabilities in the NETGEAR FVS318 router. A remote user can bypass the URL filter. A remote user can also conduct cross-site scripting attacks.

The Security Log does not properly filter HTML code from user-supplied URLs when logging blocked URLs. A remote user can supply a specially crafted URL containing a string that will be blocked by the router and also containing scripting code. Then, when the target administrator views the Security Log, arbitrary scripting code will be executed by the target administrator's browser. The code will originate from the router running the vulnerable software and will run in the security context of that router. As a result, the code will be able to access the target administrator's cookies (including authentication cookies), if any, associated with the router, access data recently submitted by the target administrator via web form to the router, or take actions on the router acting as the target administrator.

A demonstration exploit URL is provided [where 'somefile.exe' or '.exe' is a string to be blocked by the URL filter]:

http://[target]/somefile.exe</textarea><script>alert('XSS')</script>

A remote user can use Hex encoded characters in a URL to bypass the URL filter.

The original advisory is available at:

http://www.securinews.com/vuln.htm?vulnid=103

Impact:   A remote user can access the target administrator's cookies (including authentication cookies), if any, associated with the router running the vulnerable software, access data recently submitted by the target administrator via web form to the router, or take actions on the router acting as the target administrator.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.netgear.com/ (Links to External Site)
Cause:   Access control error, Input validation error

Message History:   None.


 Source Message Contents

Subject:  Multiple Vulnerabilities in Netgear FVS318 Router


Multiple Vulnerabilities in Netgear FVS318 Router

http://www.securinews.com/vuln.htm?vulnid=103
-------------------------------------------------

Overview:
The Netgear FVS318 is an easy to use, firewall/router designed for home users and small 
businesses. SecuriNews Research has found 2 vulnerabilities in the router.


Vendor:
Netgear (http://www.netgear.com)


Affected Systems/Configuration:
2.4, possibly others


Vulnerabilities/Exploits:

1) By using HEX encoded characters, it is possible to bypass the URL filter. For 
example, if the router administrator blocks the phrase ".exe"; a user can encode one or 
more characters in the URL phrase to bypass the filter. If we encode the 'x' in ".exe", 
the new phrase ".e%78e" will bypass the filter.

2) The content filter/log viewer contains a Cross Site Scripting vulnerability. When a 
user tries to access a blocked URL phrase, it is logged in the Security Log. If a user 
were to inject JavaScript into a blocked URL phrase, the JavaScript would be executed 
by the admin's browser when the security log is viewed.


Proof of Concept:

1) Example above.

2) If the router administrator has blocked the URL phrase ".exe", a user can inject 
JavaScript as follows:

http://www.example.com/somefile.exe</textarea><script>alert('XSS')</script>

Note: The string "</textarea>" must be added before the injected JavaScript, as the 
security log is placed in a text area.


Workaround:
None.


Date Discovered:
January 14, 2005


Severity:
Low-Medium


Credit:
SecuriNews Research
http://www.securinews.com/
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC