Longshine Multiple Print Servers Cross Site Scripting

`GotGeek Labs  
http://www.gotgeek.com.br/  
  
Longshine Multiple Print Servers Cross-site Scripting Vulnerability  
  
  
  
[+] Description  
  
LCS-PS110:  
The LCS-PS110 Parallel-Port-Printserver enables you to share your printer  
in the whole network from every workstation. This multiprotocol printserver  
supports the most common network protocols and operating systems. For  
easy configuration and administration it supports SNMP, Web-Interface and  
other configuration and management tools.  
  
LCS-PS101-A:  
The LCS-PS101-A is a small, handy Printserver for Printers with USB-Connector.  
The Printserver is the comfortable solution to connect Ink, Colour, Laser  
or Pinprinter to your Network with 10 or 100Mbit/s. The Printer will be  
connected over a high-speed USB 2.0 standard port. It supports the most common  
Operating Systems. You can configure and administrate the Printserver with  
several Software and Web-Interfaces. The Printserver is the ideal device for  
flexible operations in envirements like Home-Offices or small and middle  
sized Offices.  
  
LCS-PS112:  
The LCS-PS112 Printserver connects your Printers directly to the Network  
and gives every workstation in the network access for printing. The LCS–PS112  
provides 2 x USB printerports and 1x Parallel printerport enablinge three  
Printers to share the whole Network. Easy and fast to configure with the  
PS-Admin-Tool. The LCS-PS112 is the right solution for small offices but also  
a Enterprise solution for Printerfarms.  
  
  
  
[+] Information  
  
Title: Longshine Multiple Print Servers Cross-site Scripting Vulnerability  
Shodan Dork: ZOT-PS-47/9.8.0015 -WWW-Authenticate  
ZOT-PS-35/6.2.0001 -WWW-Authenticate  
ZOT-PS-39/6.3.0007 -WWW-Authenticate  
Advisory: gg-010-2011  
Date: 03-15-2011  
Last update: 03-26-2011  
Link: http://www.gotgeek.com.br/pocs/gg-010-2011.txt  
  
  
  
[+] Vulnerabilities  
  
Stored Cross-site Scripting:  
Web interface from PS110, PS101-A and PS112 Print Servers are affected by stored  
cross-site scripting vulnerability because it fails to properly sanitize  
user-supplied input at "NDSContext" field in "NetWare NDS Settings" area.  
An attacker may leverage this issue to execute arbitrary script code  
in the browser of an unsuspecting user in the context of the affected site.  
  
After injecting the XSS code, you need to access Netware status page.  
  
  
Affected Versions:  
  
Longshine LCS-PS110 Parallel-Port-Printserver  
Firmware: 9.08.47L 0015 (ZOT-PS-47/9.8.0015)  
8.02.30L (ZOT-PS-30/8.2.0004)  
  
Longshine LCS-PS101-A USB-Printserver  
Firmware: 9.08.47L 0015 (ZOT-PS-47/9.8.0015)  
6.02.35L (ZOT-PS-35/6.2.0001)  
  
Longshine LCS-PS112 Printserver  
Firmware: 6.03.39L 0007 (ZOT-PS-39/6.3.0007)  
6.03.39L 0004 (ZOT-PS-39/6.3.0004)  
  
Other versions may also be vulnerable.  
  
  
  
[+] Proof of Concept/Exploit  
  
XSS:  
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>  
  
and then..  
  
http://target/NETWARE.HTM  
  
  
  
[+] Timeline  
  
24-03-2011: first contact to vendor.  
29-03-2011: second contact to vendor.  
03-04-2011: no vendor response.  
04-04-2011: advisory published.  
  
  
  
[+] References  
  
http://www.longshine.de/longshine/products/printserver/PS110/PS110_eng.pdf  
http://www.longshine.de/longshine/products/printserver/PS101-A/PS101-A_eng.pdf  
http://www.longshine.de/longshine/products/printserver/PS112/PS112_eng.pdf  
  
  
  
[+] Credits  
  
b0telh0  
`