Teltonika RUT9XX Reflected Cross-Site Scripting (XSS)
Vulnerability Overview
Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to
cross-site scripting vulnerabilities in hotspotlogin.cgi due to
insufficient user input sanitization.
- Identifier : SBA-ADV-20180410-01
- Type of Vulnerability : Cross Site Scripting
- Software/Product Name : Teltonika RUT955
- Vendor : Teltonika
- Affected Versions : Firmware RUT9XX_R_00.05.00.5 and probably prior
- Fixed in Version : RUT9XX_R_00.05.01.1
- CVE ID : CVE-2018-17533
- CVSSv3 Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- CVSSv3 Base Score : 8.2 (High)
Vendor Description
RUT955 is a highly reliable and secure LTE router with I/O, GNSS and RS232/RS485 for professional applications. Router delivers high performance, mission-critical cellular communication and GPS location capabilities.
Source: https://teltonika.lt/product/rut955/
Impact
By exploiting the documented vulnerabilities, an attacker can execute JavaScript code in a user's browser within the origin of the router. The attacker might take over existing or future administrative web management sessions and gain access to the device.
We recommend upgrading to version RUT9XX_R_00.05.01.1 or newer, which includes fixes for the vulnerabilities described in this advisory.
Vulnerability Description
Several parameters of the script hotspotlogin.cgi are affected by
reflected cross-site scripting vulnerabilities. The scripts are part of
the coova-chilli captive portal. However, in firmware versions before
RUT9XX_R_00.04.233 the vulnerabilities are exploitable regardless of
the device configuration, even if no captive portal is configured.
More concretely, the following parameters are vulnerable:
/cgi-bin/hotspotlogin.cgi- If res=failed or res=notyet
- challenge
- uamip
- uamport
- userurl
- If res=failed or res=notyet
The affected script outputs these input parameters in an HTML context without proper output encoding.
The vulnerabilities are located in hotspotlogin.cgi:
[...]
elseif result == 2 or result == 5 then
replace_tags.formHeader = [[<form name="myForm" method="post" action="]] .. loginpath .. [[">
<INPUT TYPE="hidden" NAME="challenge" VALUE="]] .. challenge .. [[">
<INPUT TYPE="hidden" NAME="]] .. names["uamip"] .. [[" VALUE="]] .. uamip .. [[">
<INPUT TYPE="hidden" NAME="]] .. names["uamport"] .. [[" VALUE="]] .. uamport .. [[">
<INPUT TYPE="hidden" NAME="]] .. names["userurl"] .. [[" VALUE="]] ..userurldecode .. [[">
<INPUT TYPE="hidden" NAME="res" VALUE="]] .. res .. [[">]]
replace_tags.formFooter = [[</form>]]
[...]As the above code snippet shows, the parameter userurl contains user
input and is output without performing any HTML escaping.
Proof-of-Concept
An attacker can exploit this vulnerability by manipulating the userurl
query parameter:
http://<IP>/cgi-bin/hotspotlogin.cgi?res=failed&userurl="><script>alert(1)</script><span
An attacker can exploit the other parameters (e.g. challenge) via POST requests:
<form action="http://<IP>/cgi-bin/hotspotlogin.cgi" method="post" enctype="text/plain">
<input type="hidden" name="res" value="failed&challenge="><script>alert(1)</script><span"">
<input type="submit" value="challenge">
</form>Timeline
2018-04-10identification of vulnerability in version RUT9XX_R_00.04.1612018-04-16re-test of version RUT9XX_R_00.04.1722018-04-16initial vendor contact through public address2018-04-18vendor response with security contact2018-04-19disclosed vulnerability to vendor security contact2018-04-26vendor released fix in version RUT9XX_R_00.04.2332018-07-09notify vendor about incomplete fix in version RUT9XX_R_00.05.00.52018-07-19vendor released fix in version RUT9XX_R_00.05.01.12018-07-25re-test of version RUT9XX_R_00.05.01.22018-09-25request CVE from MITRE2018-09-26MITRE assigned CVE-2018-175332018-10-11public disclosure
References
- Firmware Changelog: https://wiki.teltonika.lt/index.php?title=RUT9xx_Firmware
Credits
- David Gnedt (SBA Research)