######################################################################
# Exploit Title: SmoothWall 3.1 Multiple vulnerabilities
# Date: 21/12/2014
# Author: Yann CAM @ Synetis
# Vendor or Software Link: www.smoothwall.org - www.smoothwall.org/download/
# Version: 3.1
# Category: CSRF password reset & XSS persistent
# Google dork:
# Tested on: Smoothwall Linux distribution
######################################################################
Smoothwall firewall/router distribution description :
======================================================================
Smoothwall is a Linux distribution designed to be used as an open source firewall. Designed for ease of use, Smoothwall is configured via a web-based GUI, and requires little or no knowledge of Linux to install or use.
Smoothwall is also a private software company based in the UK that develops firewall and web content filtering software, and which also maintains the SmoothWall open source project.
In version 3.0 SP3, many XSS persistent and CSRF vulnerabilities are present (test on march 2013). Dave B has already published some XSS PoC in a January 17, 2011, which have not been corrected (exploit-db 16006).
The present advisory adds new persistent XSS vectors and PoC for a similar impact. The SmoothWall 3.1 released on october 2014, is still affected by these attack vectors.
Smoothwall webGui is simply protected by a Basic Auth (htaccess) without session token. So any page is CSRF vulnerable.
The httpd daemon listens on HTTP on port 81 and HTTPS on port 441.
Proof of Concept 1 :
======================================================================
XSS persistent through POST : affect SmoothWall 3.0SP3 and 3.1
File /httpd/cgi-bin/pppsetup.cgi line 365 :
print "\t