Lucene search

K
exploitdbKeith ThomeEDB-ID:43158
HistoryNov 17, 2017 - 12:00 a.m.

Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting

2017-11-1700:00:00
Keith Thome
www.exploit-db.com
23

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.003

Percentile

71.4%

# Exploit Title: Icon Time Systems RTC-1000 (<= v2.5.7458) Universal Time Clocks Stored XSS Vulnerability
# Date: 17-11-2017
# Vendor: http://www.icontime.com/
# Version: <= v2.5.7458
# Exploit Author: Keith Thome
# Contact: https://twitter.com/keiththome
# Website: https://www.keiththome.com/rtc-1000-vuln
# CVE: CVE-2017-16819
# Type: Remote
# Platform: Hardware

==========================================================

# Introduction
The Icon Time Systems RTC-1000 (firmware v2.5.7458 and below) Universal Time Clock device is susceptible to a stored Cross Site Scripting (XSS) vulnerability that facilitates session hijacking. Injecting a session hijacking XSS payload into the β€˜First Name’ field of an employee record on the employee.html webpage results in payload execution wherever this employee's first name appears in subsequent webpages. Caveat: To exploit this vulnerability, the attacker does need valid credentials to access the device and those credentials must have permissions to change employee names.

==========================================================

# Vulnerable URL (Employee Maintenance Module)
/employee.html

# Vulnerable parameter(s)
- First Name input ID: nameFirst

# Sample payload
<script>alert("xss");</script>

==========================================================

# PROOF OF CONCEPT
- With valid credentials that has permissions to modify the employee records, access the employeelist.html page via Lists->Employees
- Click on an active employee or Show Inactive to modify an employee record.
- Click on the employee id or name to access the vulnerable employee.html page.
- In the First Name field, enter a XSS payload.
- Click Submit
- Once any user accesses a page where that employee's first name is displayed, the XSS will be executed. Ie. employeelist.html that lists all employees.

==========================================================

# Timeline
- 09/08/2017 - Vulnerability discovered.
- 09/15/2017 - Vendor informed.
- 09/19/2017 - Vendor informed.
- 09/19/2017 - Vendor acknowleged and indicated patch development underway.
- 10/24/2017 - Emailed vendor for update. No response.
- 11/17/2017 - Public Disclosure

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.003

Percentile

71.4%