CVE-2024-41584
📋 TL;DR
This vulnerability allows authenticated attackers to inject malicious scripts via the sFormAuthStr parameter, which are then executed in victims' browsers when they view the affected page. It affects DrayTek Vigor3910 network devices running firmware up to version 4.3.2.6. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- DrayTek Vigor3910
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could steal session cookies, perform actions as the victim user, or redirect to malicious sites, potentially leading to full device compromise if combined with other vulnerabilities.
Likely Case
Attackers with valid credentials could perform session hijacking, steal sensitive information displayed in the web interface, or deploy phishing attacks against other users.
If Mitigated
With proper network segmentation and access controls limiting authenticated users to trusted personnel only, impact is limited to potential credential theft from authorized users.
🎯 Exploit Status
Exploitation requires authenticated access to the web interface. The vulnerability is in parameter validation, making exploitation straightforward for authenticated attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version after 4.3.2.6
Vendor Advisory: https://www.draytek.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Log into DrayTek Vigor3910 web interface. 2. Navigate to System Maintenance > Firmware Upgrade. 3. Download latest firmware from DrayTek support site. 4. Upload and apply firmware update. 5. Reboot device after update completes.
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to the web management interface to trusted IP addresses only using firewall rules.
Implement WAF Rules
allDeploy web application firewall rules to block XSS payloads targeting the sFormAuthStr parameter.
🧯 If You Can't Patch
- Implement strict access controls limiting web interface access to trusted administrators only
- Monitor for suspicious parameter values in web server logs and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface under System Maintenance > Firmware Information. If version is 4.3.2.6 or earlier, device is vulnerable.Check Version:
No CLI command available. Must check via web interface at System Maintenance > Firmware Information.Verify Fix Applied:
After updating, verify firmware version shows a version higher than 4.3.2.6 in System Maintenance > Firmware Information.📡 Detection & Monitoring
Log Indicators:
- Unusual sFormAuthStr parameter values in web server logs
- Multiple failed login attempts followed by successful login and XSS payload
Network Indicators:
- HTTP requests containing script tags or JavaScript in sFormAuthStr parameter
- Unusual outbound connections from admin workstations
SIEM Query:
web.url:*sFormAuthStr=* AND (web.url:*script* OR web.url:*javascript* OR web.url:*onload* OR web.url:*onerror*)