110 lines
No EOL
3.3 KiB
Text
110 lines
No EOL
3.3 KiB
Text
GotGeek Labs
|
||
http://www.gotgeek.com.br/
|
||
|
||
Longshine Multiple Print Servers Cross-site Scripting Vulnerability
|
||
|
||
|
||
|
||
[+] Description
|
||
|
||
LCS-PS110:
|
||
The LCS-PS110 Parallel-Port-Printserver enables you to share your printer
|
||
in the whole network from every workstation. This multiprotocol printserver
|
||
supports the most common network protocols and operating systems. For
|
||
easy configuration and administration it supports SNMP, Web-Interface and
|
||
other configuration and management tools.
|
||
|
||
LCS-PS101-A:
|
||
The LCS-PS101-A is a small, handy Printserver for Printers with USB-Connector.
|
||
The Printserver is the comfortable solution to connect Ink, Colour, Laser
|
||
or Pinprinter to your Network with 10 or 100Mbit/s. The Printer will be
|
||
connected over a high-speed USB 2.0 standard port. It supports the most common
|
||
Operating Systems. You can configure and administrate the Printserver with
|
||
several Software and Web-Interfaces. The Printserver is the ideal device for
|
||
flexible operations in envirements like Home-Offices or small and middle
|
||
sized Offices.
|
||
|
||
LCS-PS112:
|
||
The LCS-PS112 Printserver connects your Printers directly to the Network
|
||
and gives every workstation in the network access for printing. The LCS–PS112
|
||
provides 2 x USB printerports and 1x Parallel printerport enablinge three
|
||
Printers to share the whole Network. Easy and fast to configure with the
|
||
PS-Admin-Tool. The LCS-PS112 is the right solution for small offices but also
|
||
a Enterprise solution for Printerfarms.
|
||
|
||
|
||
|
||
[+] Information
|
||
|
||
Title: Longshine Multiple Print Servers Cross-site Scripting Vulnerability
|
||
Shodan Dork: ZOT-PS-47/9.8.0015 -WWW-Authenticate
|
||
ZOT-PS-35/6.2.0001 -WWW-Authenticate
|
||
ZOT-PS-39/6.3.0007 -WWW-Authenticate
|
||
Advisory: gg-010-2011
|
||
Date: 03-15-2011
|
||
Last update: 03-26-2011
|
||
Link: http://www.gotgeek.com.br/pocs/gg-010-2011.txt
|
||
|
||
|
||
|
||
[+] Vulnerabilities
|
||
|
||
Stored Cross-site Scripting:
|
||
Web interface from PS110, PS101-A and PS112 Print Servers are affected by stored
|
||
cross-site scripting vulnerability because it fails to properly sanitize
|
||
user-supplied input at "NDSContext" field in "NetWare NDS Settings" area.
|
||
An attacker may leverage this issue to execute arbitrary script code
|
||
in the browser of an unsuspecting user in the context of the affected site.
|
||
|
||
After injecting the XSS code, you need to access Netware status page.
|
||
|
||
|
||
Affected Versions:
|
||
|
||
Longshine LCS-PS110 Parallel-Port-Printserver
|
||
Firmware: 9.08.47L 0015 (ZOT-PS-47/9.8.0015)
|
||
8.02.30L (ZOT-PS-30/8.2.0004)
|
||
|
||
Longshine LCS-PS101-A USB-Printserver
|
||
Firmware: 9.08.47L 0015 (ZOT-PS-47/9.8.0015)
|
||
6.02.35L (ZOT-PS-35/6.2.0001)
|
||
|
||
Longshine LCS-PS112 Printserver
|
||
Firmware: 6.03.39L 0007 (ZOT-PS-39/6.3.0007)
|
||
6.03.39L 0004 (ZOT-PS-39/6.3.0004)
|
||
|
||
Other versions may also be vulnerable.
|
||
|
||
|
||
|
||
[+] Proof of Concept/Exploit
|
||
|
||
XSS:
|
||
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>
|
||
|
||
and then..
|
||
|
||
http://target/NETWARE.HTM
|
||
|
||
|
||
|
||
[+] Timeline
|
||
|
||
24-03-2011: first contact to vendor.
|
||
29-03-2011: second contact to vendor.
|
||
03-04-2011: no vendor response.
|
||
04-04-2011: advisory published.
|
||
|
||
|
||
|
||
[+] References
|
||
|
||
http://www.longshine.de/longshine/products/printserver/PS110/PS110_eng.pdf
|
||
http://www.longshine.de/longshine/products/printserver/PS101-A/PS101-A_eng.pdf
|
||
http://www.longshine.de/longshine/products/printserver/PS112/PS112_eng.pdf
|
||
|
||
|
||
|
||
[+] Credits
|
||
|
||
b0telh0 |