Stored XSS in NR255-V QoS Rule Management

Executive Summary

NR255-V version 1.5.130703 does not properly sanitize QoS rule names before processing them via eval() in specific CGI handlers. This allows an attacker to inject malicious script code through crafted QoS rule name input. The injected code executes when the stored data is later processed by the affected handlers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves persistent script code injection via QoS rule names in NR255-V version 1.5.130703. To detect it, inspect QoS rule names for unusual or obfuscated characters, especially in handlers like qos_xianz_add_cgi or qos_filter_add_cgi. Check logs for eval() function usage in these contexts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute persistent cross-site scripting (XSS) attacks. This may lead to unauthorized access to user sessions, theft of sensitive data, or manipulation of displayed content. The impact depends on the privileges of the affected application and the context in which the CGI handlers are used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information (PHI) integrity. Compliance risks include potential fines, reputational damage, and mandatory breach notifications under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update NR255-V to the latest version that patches the eval() sanitization issue in QoS rule handlers. If an update is unavailable, disable or restrict access to the affected CGI handlers (qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, qos_filter_show_cgi) until a fix is applied.

Useful 0 Not Useful 0