EDIMAX AR-6004 Full Rate ADSL Router Cross Site Scripting Vulnerabillity

["Rafel Ivgi" <theinsider () 012 net il>]

#######################################################################

Device:            EDIMAX AR-6004 Full Rate ADSL Router Integrated 4 port
Switch
Software:         The Router's Server
Vendor:           http://www.edimax.com.tw/
Versions:         AR-6004
Platforms:       Windows
Bug:               Cross Site Scripting Vulnerabillity + Remote Compromise
Risk:               Medium
Exploitation:    Remote with browser
Date:               6 Jan 2004
Author:            Rafel Ivgi, The-Insider
e-mail:             the_insider () mail com
web:                http://theinsider.deep-ice.com

#######################################################################

1) Introduction
2) Bug
3) The Code

#######################################################################

===============
1) Introduction
===============

EDIMAX AR-6004 Full Rate ADSL Router Is a great routing device. It includes
4 port Switch.
Device Details: http://www.edimax.com.tw/html/english/products/AR-6004.htm

#######################################################################

======
2) Bug
======

When a connection is established with the webserver it requires
authentification.
First of all there is a default username and password admin:1234 which is no
bug,
But the user and pass are *presented to the user connecting as the default
logon text*,
This is a default configuration which is a gate for trouble. In addition
when someone
gets inside the router and goes to the config area the dial up username and
password
can be easily stolen, not to mention the risk of this text-form passwords
being sniffed from
the network.

The Vulnerabillity is mainly  Cross Site Scripting. If an attacker will
request the following
url from the server http://<host>/<script>alert('XSS')</script>, when the
connection is
established with the webserver it requires authentification, if cancel is
pressed
 XSS appears and the server allows an attacker to inject & execute scripts.

#######################################################################

===========
3) The Code
===========

http://<host>/<script>alert('XSS')</script>

#######################################################################

---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com

"Things that are unlikeable, are NOT impossible."