exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Yealink VOIP Phone Cross Site Scripting

Yealink VOIP Phone Cross Site Scripting
Posted Mar 13, 2012
Authored by Narendra Shinde

Yealink VOIP Phone suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2012-1417
SHA-256 | 594dab55fa06525eeb25a234672469d458221c09b400c782310c5903d307c318

Yealink VOIP Phone Cross Site Scripting

Change Mirror Download

==============================================================
Secur-I Research Group Security Advisory [ SV-2012-005]
==============================================================
Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability
Product: Yealink Easy VOIP Phone
Homepage: http://www.yealink.com/
Impact: Medium
Authentication: Required
CVE: CVE-2012-1417
Vulnerability ID: SV-2012-005
Found: 2012-02-21
Author: Narendra Shinde
Secur-I Research Group
http://securview.com/
===================================================
Vendor description:
---------------------------
Yealink is the professional designer and manufacturer of IP Phone and IP Video Phone for the world-wide broadband telephony market. For more than ten years, Yealink has focused on VoIP products characterized by high cost-performance, easy deployment and affordable price.
Source: http://www.yealink.com/index.php/Company/


Vulnerability Information:
-----------------------------------
1) Multiple Cross Site Scripting vulnerabilities

Vulnerability Information:
-------------------------------------
Class: Improper Neutralization of Input during Web Page Generation ('Cross-site Scripting') [CWE-79]
Impact: Insertion and Execution of malicious scripts in user browser
Remotely Exploitable: Yes
Authentication Required: Yes
User interaction Required : Yes

Vulnerability overview/description:
-------------------------------------------------
Yealink Easy Voip phone is prone to multiple cross-site scripting vulnerabilities as the user-supplied input received via certain parameters is not properly sanitized. This can be exploited by submitting specially crafted input to the affected software. Successful exploitation could allow the attacker to execute arbitrary script code within the user's browser session in the security context of the targeted site. The attacker could redirect user to malicious site, gain access to user's cookies (including authentication cookies), if any, associated with the targeted site, access recently submitted data by the target user via web forms, or take actions on the site masquerading as the target user.

Description:

While adding contact information on Contacts page , user input is not properly sanitized.
The "name" field in Local Phone book and Blacklist form is vulnerable to script injection attacks.

Exploitation:
- Login using normal user (Default is user:user)
- Visit Contacts page at http://x.x.x.x/cgi-bin/ConfigManApp.com?Id=9
- Insert "><img src=0 onerror=alert(/xss/) />

Device use common contact page for normal user and Admin user.Therefore any malicious input from user account on Contact page direclty affects admin user.


Workaround:
------------------
- Filter all unnecessary special characters from user input
- Use character escaping and encoding
- For more details please refer:
https://www.owasp.org/index.php/Cross- Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet

Timeline:
---------
Vulnerability Found : 2012-02-21
Reported to Vendor : 2012-02-23
Response from vendor support : 2012-02-27 (Contact the distributor in area not the vendor)

Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close