3 ms·
You don't need XSS, that's not interesting at all. You can get the admin password from an insecure page, and then there's also a page to run commands as root.
by vsareto 6y ago
You don't need XSS, that's not interesting at all. You can get the admin password from an insecure page, and then there's also a page to run commands as root.
- dehrmann 6y agoRight, but you have to be on the local network to do that...unless the webserver also listens on the WAN interface.
- vsareto 6y agoHe doesn't demonstrate an attack over the internet in this article, but this makes me think he did investigate it from a remote attacker perspective vs. local network: >So what does that get us from the perspective of a remote attacker? We have the ability to get the current admin credentials, and we can get a shell if the telnet binary is started. However, most remote attackers wont be able to solder on any wires, so I wasn’t going to stop there. >Going through the rest of the pages in the www directory, there is another web page that provides this interface: So you don't need telnet, but the creds being on the page + knowledge of the system command page would be enough to do whatever you wanted. Also see this follow-up research page on the same devices: https://james-clee.com/2020/04/23/more-information-disclosure-in-wavlink-devices/ https://james-clee.com/2020/04/23/more-information-disclosur... >Just a reminder – every screenshot below is of a web page that is externally accessible without requiring authentication and contains sensitive data.
- fhrow4484 6y ago> Right, but you have to be on the local network to do that But who is "you" here? Are you assuming the attacker needs to be physically present on your network? can any malicious script running on browser's victim make an xhr request to "192.168.0.1/page-which-exposes-password"?
- deleted 6y ago[deleted]