CVE-2023-50231
📋 TL;DR
This is a stored cross-site scripting (XSS) vulnerability in NETGEAR ProSAFE Network Management System that allows remote attackers to inject malicious scripts via the saveNodeLabel method. When exploited, it enables privilege escalation to access protected resources. Affected users are those running vulnerable versions of NETGEAR NMS300.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System 300 (NMS300)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative privileges, take full control of the NMS system, compromise managed network devices, and potentially pivot to internal networks.
Likely Case
Attackers escalate privileges to access sensitive network management functions, modify device configurations, and potentially steal credentials.
If Mitigated
With proper input validation and output encoding, the script injection is prevented, maintaining normal user privilege boundaries.
🎯 Exploit Status
Requires authenticated access but minimal user interaction. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.15
Vendor Advisory: https://kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106
Restart Required: Yes
Instructions:
1. Download NMS300 version 1.7.0.15 from NETGEAR support site. 2. Backup current configuration. 3. Install the update following NETGEAR's upgrade guide. 4. Restart the NMS service or server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize node label inputs before processing.
Web Application Firewall
allDeploy WAF with XSS protection rules to block malicious script injection attempts.
🧯 If You Can't Patch
- Isolate NMS300 system from internet and restrict access to trusted networks only.
- Implement strict access controls and monitor for unusual administrative activity.
🔍 How to Verify
Check if Vulnerable:
Check NMS300 version in web interface under Help > About or system settings.Check Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify version is 1.7.0.15 or later and test saveNodeLabel functionality with script-like input.📡 Detection & Monitoring
Log Indicators:
- Unusual saveNodeLabel requests with script tags
- Multiple privilege escalation attempts
- Administrative actions from non-admin users
Network Indicators:
- HTTP POST requests to saveNodeLabel endpoint containing script elements
- Unexpected administrative traffic patterns
SIEM Query:
source="nms300" AND (uri_path="/saveNodeLabel" AND (content="<script>" OR content="javascript:"))🔗 References
- https://kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106
- https://www.zerodayinitiative.com/advisories/ZDI-23-1847/
- https://kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106
- https://www.zerodayinitiative.com/advisories/ZDI-23-1847/
