CVE-2013-7389
published 2014-07-07CVE-2013-7389: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary…
PriorityP271medium4.3CVSS 2.0
AVNACMAuNCNIPAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
27.75%
98.1th percentile
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-645 | — | — |
| dlink | dir-645_firmware | <= 1.03 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandcurl -b uid=test -d $(perl -e 'print "uid=test&password=asd" . "A"x2024;') http:///authentication.cgi↗
- →Detect XSS attempts targeting the 'deviceid' parameter in GET requests to /parentalcontrols/bind.php on D-Link DIR-645 devices. ↗
- →Detect XSS attempts targeting the 'RESULT' parameter in GET requests to /info.php on D-Link DIR-645 devices. ↗
- →Detect XSS attempts targeting the 'receiver' parameter in GET requests to /bsc_sms_send.php on D-Link DIR-645 devices. ↗
- →Detect oversized 'hash' GET parameter (>= 292 characters) in requests to /post_login.xml, indicative of stack buffer overflow exploitation attempt against /usr/sbin/widget. ↗
- →Detect HTTP requests to /hedwig.cgi with an oversized 'uid' cookie value (>= 1400 bytes), indicative of buffer overflow exploitation. ↗
- →Detect HTTP POST requests to /authentication.cgi with an oversized 'password' parameter (>= 2024 bytes appended to uid=test&password=asd), indicative of buffer overflow exploitation. ↗
- →All three buffer overflow vulnerabilities (post_login.xml, hedwig.cgi, authentication.cgi) are exploitable without authentication — monitor for unauthenticated access to these endpoints. ↗
- →Metasploit modules exist for hedwig.cgi and authentication.cgi buffer overflows; monitor for exploitation patterns matching DIR645A1_FW103B11 firmware targets. ↗
- ·The XSS vulnerabilities (CVE-2013-7389) are distinct from the buffer overflow vulnerabilities described in the same advisory; the CVE specifically covers only the XSS issues in bind.php, info.php, and bsc_sms_send.php. ↗
- ·Firmware versions DIR865LA1_FW101b06 and DIR845LA1_FW100b20 are also noted as vulnerable to the authentication.cgi buffer overflow, broadening the affected scope beyond DIR-645. ↗
- ·The advisory was tested specifically against D-Link DIR-645 firmware 1.03B08; other products and firmware versions could also be vulnerable but were not verified. ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w84x-2hxj-9gfv: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev
ghsa_unreviewed·2022-05-17
CVE-2013-7389 [MEDIUM] CWE-79 GHSA-w84x-2hxj-9gfv: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.
VulnCheck
D-Link DIR-645 Router Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2013·CVSS 4.3
CVE-2013-7389 [MEDIUM] D-Link DIR-645 Router Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
D-Link DIR-645 Router Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.
Affected: D-Link DIR-645 Router
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/
No detection rules found.
Exploit-DB
D-Link DIR-645 1.03B08 - Multiple Vulnerabilities
exploitdb·2013-08-02
CVE-2013-7389 D-Link DIR-645 1.03B08 - Multiple Vulnerabilities
D-Link DIR-645 1.03B08 - Multiple Vulnerabilities
---
Multiple vulnerabilities on D-Link DIR-645 devices
[ADVISORY INFORMATION]
Title: Multiple vulnerabilities on D-Link DIR-645 devices
Discovery date: 06/03/2013
Release date: 02/08/2013
Advisory URL: http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt
Credits: Roberto Paleari ([email protected], twitter: @rpaleari)
[AFFECTED PRODUCTS]
This security vulnerability affects the following products and firmware
versions:
* D-Link DIR-645, 1.03B08
Other products and firmware versions could also be vulnerable, but they were
not checked.
[VULNERABILITY DETAILS]
This router model is affected by multiple security vulnerabilities. All of them
are exploitable by remote, unauthenticated attackers. Details are outlined in
the followin
Metasploit
D-Link authentication.cgi Buffer Overflow
metasploit
D-Link authentication.cgi Buffer Overflow
D-Link authentication.cgi Buffer Overflow
This module exploits a remote buffer overflow vulnerability on several D-Link routers. The vulnerability exists in the handling of HTTP queries to the authentication.cgi with long password values. The vulnerability can be exploitable without authentication. This module has been tested successfully on D-Link firmware DIR645A1_FW103B11. Other firmwares such as the DIR865LA1_FW101b06 and DIR845LA1_FW100b20 are also vulnerable.
Metasploit
D-Link hedwig.cgi Buffer Overflow in Cookie Header
metasploit
D-Link hedwig.cgi Buffer Overflow in Cookie Header
D-Link hedwig.cgi Buffer Overflow in Cookie Header
This module exploits an anonymous remote code execution vulnerability on several D-Link routers. The vulnerability exists in the handling of HTTP queries to the hedwig.cgi with long value cookies. This module has been tested successfully on D-Link DIR300v2.14, DIR600 and the DIR645A1_FW103B11 firmware.
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
http://osvdb.org/show/osvdb/95910http://osvdb.org/show/osvdb/95952http://osvdb.org/show/osvdb/95953http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txthttp://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008http://www.securityfocus.com/bid/61579http://osvdb.org/show/osvdb/95910http://osvdb.org/show/osvdb/95952http://osvdb.org/show/osvdb/95953http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txthttp://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008http://www.securityfocus.com/bid/61579
2014-07-07
Published
Exploited in the wild