D-Link DGL-5500/DHP-1565/DIR-652/DIR-835/DIR-855L 1.02b18 apply.cgi action cross site scripting

Summaryinfo

A vulnerability was found in D-Link DGL-5500, DHP-1565, DIR-652, DIR-835 and DIR-855L 1.02b18. It has been classified as problematic. This impacts an unknown function of the file apply.cgi. Performing a manipulation of the argument action results in cross site scripting. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in D-Link DGL-5500, DHP-1565, DIR-652, DIR-835 and DIR-855L 1.02b18 (Router Operating System). This affects an unknown code block of the file apply.cgi. The manipulation of the argument action with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on integrity.

The weakness was presented 05/22/2014 by Kyle Lovett as File 126779 as not defined advisory (Packetstorm). The advisory is shared at packetstormsecurity.com. The public release happened without involvement of D-Link. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1059.007 for this issue. The advisory points out:

For the file "apply.cgi" ("apply_sec.cgi" on the DGL-5500) the POST param "action" suffers from a XSS vulnerability due to improper neutralization of user input / return output.

A public exploit has been developed by Kyle Lovett in HTTP POST Request and been published 4 days after the advisory. The exploit is shared for download at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 32 days. During that time the estimated underground price was around $5k-$25k. The code used by the exploit is:

http://<IP>/apply.cgi

POST
graph_code=X&session_id=123456&login_n=user&login_name=8&action=%3Cbody%3E%3Chtml%3E%3Ch2%3E%3CEMBED%20src%3D%22%3Ctd%20dir%3D%22rtl%22class%3D%22skytext%22width%3D%2277%25%22%3E%3Cmarquee%20%20%20scrollAmount%3D5%20scrollDelay%3D10%20direction%3D%22right%22style%3D%22color%3Ared%3Bfont-weight%3Abold%3B%22%3ESquirrel%20Injection%22%3C%2fh2%3E%3C%2fmarquee%3E%20%3C%2fbody%3E%3C%2fhtml%3E%3C%2ftd%3E%3E&log_pass=&html_response_page=login_pic.asp&tmp_log_pass=&gcode_base64=MTg0MzU%3D
HTTP/1.1

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (93613), Exploit-DB (33520), SecurityFocus (BID 67416†) and OSVDB (106807†). Further details are available at securityadvisories.dlink.com. See VDB-13474 and VDB-13475 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DGL-5500
• DHP-1565
• DIR-652
• DIR-835
• DIR-855L

Version

• 1.02b18

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion