Title: STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting
Advisory ID: ZSL-2021-5624
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 26.01.2021
STVS is a Swiss company specializing in development of software for digital video recording for surveillance cameras as well as the establishment of powerful and user-friendly IP video surveillance networks.
Input passed to the POST parameter ‘files’ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML code in a user’s browser session in context of an affected site.
STVS SA - http://www.stvs.ch
5.9.10 (build 2885-3a8219a)
5.9.9 (build 2882-7c3b787)
5.9.7 (build 2871-a450938)
5.9.1 (build 2771-1bbed11)
5.9.0 (build 2701-6123026)
5.8.6 (build 2557-84726f7)
5.7
5.6
5.5
Ubuntu 14.04.3
nginx/1.12.1
nginx/1.4.6
nginx/1.1.19
nginx/0.7.65
nginx/0.3.61
[19.01.2021] Vulnerability discovered.
[19.01.2021] Vendor contacted.
[25.01.2021] No response from the vendor.
[26.01.2021] Public security advisory released.
provision_xss.txt
Vulnerability discovered by Gjoko Krstic - <[email protected]>
[1] https://packetstormsecurity.com/files/161158/STVS-ProVision-5.9.10-Cross-Site-Scripting.html
[2] https://cxsecurity.com/issue/WLB-2021010188
[3] https://exchange.xforce.ibmcloud.com/vulnerabilities/195723
[26.01.2021] - Initial release
[31.01.2021] - Added reference [1], [2] and [3]
Zero Science Lab
Web: https://www.zeroscience.mk
e-mail: [email protected]
<html><body><p>STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting
Vendor: STVS SA
Product web page: http://www.stvs.ch
Platform: Ruby
Affected version: 5.9.10 (build 2885-3a8219a)
5.9.9 (build 2882-7c3b787)
5.9.7 (build 2871-a450938)
5.9.1 (build 2771-1bbed11)
5.9.0 (build 2701-6123026)
5.8.6 (build 2557-84726f7)
5.7
5.6
5.5
Summary: STVS is a Swiss company specializing in development of
software for digital video recording for surveillance cameras
as well as the establishment of powerful and user-friendly IP
video surveillance networks.
Desc: Input passed to the POST parameter 'files' is not properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML code in a user's browser session in context
of an affected site.
Tested on: Ubuntu 14.04.3
nginx/1.12.1
nginx/1.4.6
nginx/1.1.19
nginx/0.7.65
nginx/0.3.61
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5624
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5624.php
19.01.2021
--
POST /archive/download HTTP/1.1
Host: 192.168.1.17
files=%3Cscript%3Ealert(document.URL)%3C%2Fscript%3E
</p></body></html>