92 lines
No EOL
2.3 KiB
Text
92 lines
No EOL
2.3 KiB
Text
GotGeek Labs
|
|
http://www.gotgeek.com.br/
|
|
|
|
Planex Mini-300PU & Mini100s Cross-site Scripting Vulnerability
|
|
|
|
|
|
|
|
[+] Description
|
|
|
|
Mini-300PU:
|
|
The PLANEX Mini-300PU is the greatest network printing solution to both
|
|
USB and Parallel printer ports. It provides 2 USB 2.0 and 1 Parallel printer
|
|
ports, which can work with 3 printers at the same time.
|
|
You could share multiple printers with your network clients in your office
|
|
or at home with different O/S Base, including Windows 2000/XP, Linux, and Mac OS 8.1,
|
|
or even higher: Unix, Netware. PLANEX Mini-300PU Printer Server is your best choice.
|
|
|
|
Mini100s:
|
|
The Mini100s parallel port print server directly attaches to a printer. The
|
|
print server supports IPP, and even a network beginner can set up the product
|
|
with ease via the supplied configuration utility for Windows "Smart Print Manager 3".
|
|
|
|
|
|
|
|
[+] Information
|
|
|
|
Title: Planex Mini-300PU & Mini100s Cross-site Scripting Vulnerability
|
|
Shodan Dork: ZOT-PS-39/6.2.0001 -WWW-Authenticate
|
|
ZOT-PS-30/8.3.0013 -WWW-Authenticate
|
|
Advisory: gg-008-2011
|
|
Date: 03-15-2011
|
|
Last update: 03-26-2011
|
|
Link: http://www.gotgeek.com.br/pocs/gg-008-2011.txt
|
|
|
|
|
|
|
|
[+] Vulnerabilities
|
|
|
|
Stored Cross-site Scripting:
|
|
Web interface from Mini-300PU and Mini100s Print Servers are affected by stored
|
|
cross-site scripting vulnerability because it fails to properly sanitize
|
|
user-supplied input at "NDSContext" field in "NetWare NDS Settings" area.
|
|
An attacker may leverage this issue to execute arbitrary script code
|
|
in the browser of an unsuspecting user in the context of the affected site.
|
|
|
|
After injecting the XSS code, you need to access Netware status page.
|
|
|
|
|
|
Affected Versions:
|
|
|
|
Planex Mini-300PU Print Server
|
|
Firmware: 6.02.39P (ZOT-PS-39/6.2.0001)
|
|
|
|
Planex Mini100s Print Server
|
|
Firmware: 8.03.30P 0013 (ZOT-PS-30/8.3.0013)
|
|
8.03.30P 0007 (ZOT-PS-30/8.3.0007)
|
|
|
|
Other versions may also be vulnerable.
|
|
|
|
|
|
|
|
[+] Proof of Concept/Exploit
|
|
|
|
XSS:
|
|
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>
|
|
|
|
and then..
|
|
|
|
http://target/NETWARE.HTM
|
|
|
|
|
|
|
|
[+] Timeline
|
|
|
|
24-03-2011: first contact to vendor.
|
|
25-03-2011: support contact response, asking more details.
|
|
27-03-2011: more information sent.
|
|
03-04-2011: no vendor response.
|
|
04-04-2011: advisory published.
|
|
|
|
|
|
|
|
[+] References
|
|
|
|
http://www.planex.net/product/print/mini-300pu.htm
|
|
http://www.planex.net/product/print/mini100s.htm
|
|
|
|
|
|
|
|
[+] Credits
|
|
|
|
b0telh0 |