Paul Kurczaba
17/01/05, 23:25
Multiple Vulnerabilities in Netgear FVS318 Router
http://www.securinews.com/vuln.htm=3Fvulnid=3D103
-------------------------------------------------
Overview:
The Netgear FVS318 is an easy to use, firewall/router designed for home =
users and small businesses. SecuriNews Research has found 2 vulnerabilit=
ies in the router.
Vendor:
Netgear (http://www.netgear.com)
Affected Systems/Configuration:
2.4, possibly others
Vulnerabilities/Exploits:
1) By using HEX encoded characters, it is possible to bypass the URL fil=
ter. For example, if the router administrator blocks the phrase ".exe"; =
a user can encode one or more characters in the URL phrase to bypass the=
filter. If we encode the 'x' in ".exe", the new phrase ".e%78e" will by=
pass the filter.
2) The content filter/log viewer contains a Cross Site Scripting vulnera=
bility. When a user tries to access a blocked URL phrase, it is logged i=
n the Security Log. If a user were to inject JavaScript into a blocked U=
RL phrase, the JavaScript would be executed by the admin's browser when =
the security log is viewed.
Proof of Concept:
1) Example above.
2) If the router administrator has blocked the URL phrase ".exe", a user=
can inject JavaScript as follows:
http://www.example.com/somefile.exe</textarea><script>alert('XSS')</scri=
pt>
Note: The string "</textarea>" must be added before the injected JavaScr=
ipt, as the security log is placed in a text area.
Workaround:
None.
Date Discovered:
January 14, 2005
Severity:
Low-Medium
Credit:
SecuriNews Research
http://www.securinews.com/
http://www.securinews.com/vuln.htm=3Fvulnid=3D103
-------------------------------------------------
Overview:
The Netgear FVS318 is an easy to use, firewall/router designed for home =
users and small businesses. SecuriNews Research has found 2 vulnerabilit=
ies in the router.
Vendor:
Netgear (http://www.netgear.com)
Affected Systems/Configuration:
2.4, possibly others
Vulnerabilities/Exploits:
1) By using HEX encoded characters, it is possible to bypass the URL fil=
ter. For example, if the router administrator blocks the phrase ".exe"; =
a user can encode one or more characters in the URL phrase to bypass the=
filter. If we encode the 'x' in ".exe", the new phrase ".e%78e" will by=
pass the filter.
2) The content filter/log viewer contains a Cross Site Scripting vulnera=
bility. When a user tries to access a blocked URL phrase, it is logged i=
n the Security Log. If a user were to inject JavaScript into a blocked U=
RL phrase, the JavaScript would be executed by the admin's browser when =
the security log is viewed.
Proof of Concept:
1) Example above.
2) If the router administrator has blocked the URL phrase ".exe", a user=
can inject JavaScript as follows:
http://www.example.com/somefile.exe</textarea><script>alert('XSS')</scri=
pt>
Note: The string "</textarea>" must be added before the injected JavaScr=
ipt, as the security log is placed in a text area.
Workaround:
None.
Date Discovered:
January 14, 2005
Severity:
Low-Medium
Credit:
SecuriNews Research
http://www.securinews.com/