[Full-disclosure] Multiple DoS, CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

To: <full-disclosure@xxxxxxxxxxxxxxxxx>
Subject: [Full-disclosure] Multiple DoS, CSRF and XSS vulnerabilities in ADSL modem Callisto 821+
From: "MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>
Date: Mon, 1 Aug 2011 21:59:44 +0300

Hello list!

This is the last advisory in which I'll warn you about new multiple security
vulnerabilities in ADSL modem Callisto 821+ (SI2000 Callisto821+ Router).
This time I will tell you about Security section of control panel, which is
full of vulnerabilities.

These are Denial of Service, Cross-Site Request Forgery and Cross-Site
Scripting vulnerabilities. In April I've already drew attention of
Ukrtelecom's representative (and this modem was bough at Ukrtelecom) about
multiple vulnerabilities in this model of Callisto modems (and other models
also could be affected).

SecurityVulns ID: 11700.

-------------------------
Affected products:
-------------------------

Vulnerable is the next model: SI2000 Callisto821+ Router: X7821 Annex A
v1.0.0.0 / Argon 4x1 CSP v1.0 (ISOS 9.0) [4.3.4-5.1]. This model with other
firmware and also other models of Callisto also must be vulnerable.

----------
Details:
----------

These attacks should be conducted on modem owner, which is logged into
control panel. Taking into account that it's unlikely to catch him in this
state, then it's possible to use before-mentioned vulnerabilities
(http://websecurity.com.ua/5161/) for conducting of remote login (for
logining him into control panel). After that it's possible to conduct CSRF
or XSS attack.

DoS (WASC-10):

Almost all functionality of control panel (that one, which works via POST)
is vulnerable to DoS attacks. It's partial DoS vulnerability, which leads to
freezing of modem on 75 seconds (at that freezing only control panel and
connection with Internet via router is working). The freezing has place at
sending of special request, and later every time at any operations of
writing (adding or changing of any settings), deleting (logs or settings),
and in some cases even at entering in section of control panel. I.e. it's
persistent partial DoS.

Sending of empty or incorrect value in parameter EmWeb_ns:vim:3 (via
GET/POST), and sometimes in some other parameters, and also at setting in
special way the names of parameters, as at XSS attacks via the names of
parameters, which I wrote about earlier (http://websecurity.com.ua/5277/),
lead to freezing of modem.

http://192.168.1.1/configuration/edit-form.html/edit?EmWeb_ns:vim:3=

It's impossible to work in control panel in such conditions. It's possible
to solve it only by restarting of the modem.

CSRF (WASC-09):

In section Security Interface Configuration
(http://192.168.1.1/configuration/firewall.html) via CSRF it's possible to
change Security State - to turn on/off Security, Firewall and IDS (and at
enabled Firewall it's possible to change Security Level), and also it's
possible to turn on/off NAT for interfaces.

In section Security: Add Interface
(http://192.168.1.1/configuration/fw_addInterface.html) via CSRF it's
possible to add interfaces.

This vulnerability allows to delete Security Interfaces. For example,
default interface (iplan):

http://192.168.1.1/configuration/fw_deleteInterface.html/fwDeleteInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A7.ImFireWall.ImFwInterfaces.iplan=ImFireWall.ImFwInterfaces.iplan

If NAT is enabled for interface, then it's possible to change its settings.
Via CSRF to add addresses in section Add Global Address Pool
(http://192.168.1.1/configuration/fw_addAddressPool.html?ImFireWall.ImFwInterfaces.ipmn)
and to add mappings in section Add Reserved Mapping
(http://192.168.1.1/configuration/fw_addReservedMapping.html?ImFireWall.ImFwInterfaces.ipmn).

In section Security Policy Configuration in subsections Firewall Port
Filters
(http://192.168.1.1/configuration/fw_filter.html?ImFireWall.ImFwPolicies.ext-int)
and Configure Validators
(http://192.168.1.1/configuration/fw_validators.html?ImFireWall.ImFwPolicies.ext-int)
via CSRF it's possible to add and delete filters.

In section Security Trigger Configuration
(http://192.168.1.1/configuration/fw_trigger.html) via CSRF it's possible to
add and delete triggers.

In section Firewall Configure Intrusion Detection
(http://192.168.1.1/configuration/fw_ids.html) via CSRF it's possible to
change settings of IDS.

In section Security Logging Configuration
(http://192.168.1.1/configuration/fw_logging.html) via CSRF it's possible to
turn on/off logging and change its settings.

XSS (WASC-08):

There are many persistent XSS vulnerabilities in all above-mentioned
sections.

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=ImFwInterface&EmWeb_ns%3Avim%3A2._interface%3AInterfaceName=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_addInterface.html/fwAddInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A10._interface=ImFwInterface&EmWeb_ns%3Avim%3A2._interface%3AInterfaceType=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://192.168.1.1/configuration/fw_deleteInterface.html/fwDeleteInterface?EmWeb_ns%3Avim%3A3=%2Fconfiguration%2Ffirewall.html&EmWeb_ns%3Avim%3A7.%3Cscript%3Ealert(document.cookie)%3C/script%3E=

And also in section Security Interface Configuration itself and in sections
Add Global Address Pool, Add Reserved Mapping, in subsections Firewall Port
Filters and Configure Validators of section Security Policy Configuration,
in sections Security Trigger Configuration, Firewall Configure Intrusion
Detection and Security Logging Configuration there are persistent XSS
vulnerabilities in all text fields and some hidden fields.

And also attacks via the names of parameters are possible (when XSS code is
setting in the name of parameter), which I wrote about earlier.

In this case the code will be executed immediately, and also at visiting of
pages http://192.168.1.1/system/events.html and
http://192.168.1.1/shared/event_log_selection.html.

------------
Timeline:
------------

2011.04.14 - informed Ukrtelecom about multiple vulnerabilities in modems,
which they give (sell) to their clients.
2011.05.26 - first time informed developers about holes in their router.
2011.07.30 - disclosed at my site.
2011.07.31 - informed developers (Iskratel).

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5302/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/