-----------------------------
|| WWW.SMASH-THE-STACK.NET ||
-----------------------------

|| ADVISORY: NETGEAR SSL312 XSS VULNERABILITY

_____________________
|| 0x00: ABOUT ME
|| 0x01: DATELINE
|| 0x02: INFORMATION
|| 0x03: EXPLOITATION
|| 0x04: RISK LEVEL
____________________________________________________________
____________________________________________________________

_________________
|| 0x00: ABOUT ME

Author: SkyOut
Date: October 2007
Contact: skyout[-at-]smash-the-stack[-dot-]net
Website: www.smash-the-stack.net

_________________
|| 0x01: DATELINE

2007-10-08: Bug found
2007-10-09: Phone call with Netgear Germany
2007-10-09: Email with notification sent to Netgear Germany
2007-10-12: Still no reaction from Netgear Germany
2007-10-13: Advisory released

____________________
|| 0x02: INFORMATION

In the product "Netgear SSL312 PROSAFE SSL VPN-Concentrator 25",
which is a VPN router for smaller to medium business companies and
priced about 400 Euro, a bug occurs in the login page due to the
fact of an unfiltered variable. It is possible to execute JavaScript
code on the webinterface. It may be possible, that other products
of this series are vulnerable to this bug, too (not tested!).

_____________________
|| 0x03: EXPLOITATION

To exploit this bug no exploit is needed, all can be done trough
the webinterface of the router in five simple steps:

STEP 1:
Go to the webinterface of the router, located at "/cgi-bin/welcome"
by default.

STEP 2:
Wihout giving any further parameters click LOGIN.

STEP 3:
An error page will occurr with a variable (default is "err") in the
URL. Example: "/cgi-bin/welcome/XYZ?err="

STEP 4:
Manipulate the URL and put your script code into the variable.
Demo: "/cgi-bin/welcome/XYZ?err=<script>alert('XSS');</script>"

STEP 5:
Click ENTER and the demo popup will show up. The script code has been
successfully executed.

___________________
|| 0x04: RISK LEVEL

I would consider this a smaller bug, that can only be used in very
specific situations. A successfull exploitation of this bug could
lead to Session Hijacking.

<!> Happy Hacking <!>

____________________________________________________________
____________________________________________________________

THE END

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/