Icon Time Systems RTC-1000 Firmware 2.5.7458 – Cross-Site Scripting

• Exploit Database
• 114 阅读

• 作者： Keith Thome
  日期： 2017-11-17
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/43158/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

  # Exploit Title: Icon Time Systems RTC-1000 (<= v2.5.7458) Universal Time Clocks Stored XSS Vulnerability # Date: 17-11-2017 # Vendor: http://www.icontime.com/ # Version: <= v2.5.7458 # Exploit Author: Keith Thome # Contact: https://twitter.com/keiththome # Website: https://www.keiththome.com/rtc-1000-vuln # CVE: CVE-2017-16819 # Type: Remote # Platform: Hardware   ==========================================================   # Introduction The Icon Time Systems RTC-1000 (firmware v2.5.7458 and below) Universal Time Clock device is susceptible to a stored Cross Site Scripting (XSS) vulnerability that facilitates session hijacking. Injecting a session hijacking XSS payload into the ‘First Name’ field of an employee record on the employee.html webpage results in payload execution wherever this employee&apos;s first name appears in subsequent webpages. Caveat: To exploit this vulnerability, the attacker does need valid credentials to access the device and those credentials must have permissions to change employee names.   ==========================================================   # Vulnerable URL (Employee Maintenance Module) /employee.html   # Vulnerable parameter(s) - First Name input ID: nameFirst   # Sample payload <script>alert("xss");</script>   ==========================================================   # PROOF OF CONCEPT - With valid credentials that has permissions to modify the employee records, access the employeelist.html page via Lists->Employees - Click on an active employee or Show Inactive to modify an employee record. - Click on the employee id or name to access the vulnerable employee.html page. - In the First Name field, enter a XSS payload. - Click Submit - Once any user accesses a page where that employee&apos;s first name is displayed, the XSS will be executed. Ie. employeelist.html that lists all employees.   ==========================================================   # Timeline - 09/08/2017 - Vulnerability discovered. - 09/15/2017 - Vendor informed. - 09/19/2017 - Vendor informed. - 09/19/2017 - Vendor acknowleged and indicated patch development underway. - 10/24/2017 - Emailed vendor for update. No response. - 11/17/2017 - Public Disclosure