Thomson SpeedTouch 500 modems vulnerable to XSS

[preben () watchcom no]

TITLE:
Thomson SpeedTouch 500 series vulnerable to XSS

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

SOFTWARE:
SpeedTouch 5.3.2.6.0

DESCRIPTION:
There consists a vulnerability in the SpeedTouch modems, which
can be exploited by malicious people to conduct cross-site scripting
attacks, and make a counseled user

Input passed to the LocalNetwork page isn't properly sanitized before being 
returned to the user. This can be exploited to execute arbitrary HTML and 
script code in a user's browser session in context of an affected site.

Such code can also be added through a proxy, because user validation
is only done by JavaScript. If a user is made with injected scripting code
this user will become un-delete able if the code is crafted correctly.


PoC #1 - XSS

http://[host]/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code here]

PoC #2 - Stealthy user (through proxy)

0=10&1=usrAccApply&34=NewUser&36=1&33=test&31=[code here]



SOLUTION:
Check vendor's site for firmware upgrade.
As of this writing, none is available 

PROVIDED AND DISCOVERED BY:
Preben Nyløkken