f697a81a18
12 changes to exploits/shellcodes Sony IPELA Network Camera 1.82.01 - 'ftpclient.cgi' Remote Stack Buffer Overflow BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated) BrightSign Digital Signage Diagnostic Web Server 8.2.26 - File Delete Path Traversal SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin) SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration MonoCMS Blog 1.0 - Arbitrary File Deletion (Authenticated) WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated) GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated) CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated) Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting Exhibitor Web UI 1.7.1 - Remote Code Execution
49 lines
No EOL
1.7 KiB
Text
49 lines
No EOL
1.7 KiB
Text
# Exploit Title: BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)
|
|
# Date: 2020-09-30
|
|
# Exploit Author: LiquidWorm
|
|
# Vendor Homepage: https://www.brightsign.biz
|
|
# Version: <= 8.2.26
|
|
|
|
BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF
|
|
|
|
|
|
Vendor: BrightSign, LLC
|
|
Product web page: https://www.brightsign.biz
|
|
Affected version: Model: XT, XD, HD, LS
|
|
Firmware / OS version: <=8.2.26
|
|
|
|
|
|
Summary: BrightSign designs media players and provides free software
|
|
and cloud networking solutions for the commercial digital signage market
|
|
worldwide, serving all vertical segments of the marketplace.
|
|
|
|
Desc: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability
|
|
exists in the BrightSign digital signage media player affecting the
|
|
Diagnostic Web Server (DWS). The application parses user supplied data
|
|
in the 'url' GET parameter to construct a diagnostics request to the
|
|
Download Speed Test service. Since no validation is carried out on the
|
|
parameter, an attacker can specify an external domain and force the
|
|
application to make an HTTP request to an arbitrary destination host.
|
|
This can be used by an external attacker for example to bypass firewalls
|
|
and initiate a service and network enumeration on the internal network
|
|
through the affected application.
|
|
|
|
Tested on: roNodeJS
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2020-5595
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5595.php
|
|
|
|
|
|
01.08.2020
|
|
|
|
--
|
|
|
|
|
|
PoC:
|
|
|
|
# curl http://10.0.0.17/speedtest?url=127.0.0.1:22 |