OpenWrt

XSS via missing input validation of host names displayed

·CVE-2021-32019

DESCRIPTION

Missing input validation of host names displayed in OpenWrt LuCI web-interface leads to Cross-site scripting, which can be used to gain full control over the affected system.

REQUIREMENTS

Users need to visit the LuCI “Connection status” page of the router and activate the host name resolution. The attackers need to hold a connection to the OpenWrt router which is displayed in the Web-interface, ie. via sending ICMP ping messages.

MITIGATIONS

AFFECTED VERSIONS

To our knowledge, OpenWrt version 19.07.0 to 19.07.7 are affected. The fixed packages will be integrated in the upcoming OpenWrt 19.07.8 and OpenWrt 21.02.0 release. Older versions of OpenWrt (e.g. OpenWrt 18.06, OpenWrt 15.05 and LEDE 17.01) are end of life and not supported any more.

CREDITS

This issue was identified by Philipp Jeitner and Haya Shulman from Fraunhofer SIT

REFERENCES

Full advisory on the wiki: https://openwrt.org/advisory/2021-08-01-1

← All advisories