EasyIO 30P up to 2.0.5.26 dev.htm GDN Stored cross site scripting

Summaryinfo

A vulnerability has been found in EasyIO 30P up to 2.0.5.26 and classified as problematic. The impacted element is an unknown function of the file /EASYIO30P-<session_token>/dev.htm. The manipulation of the argument GDN with the input ...'onMouseOver='alert(1);&GDG=Group&GDL=Location leads to cross site scripting (Stored). This vulnerability is listed as CVE-2018-15820. The attack may be initiated remotely. In addition, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in EasyIO 30P up to 2.0.5.26. This issue affects an unknown part of the file /EASYIO30P-<session_token>/dev.htm. The manipulation of the argument GDN with the input value ...'onMouseOver='alert(1);&GDG=Group&GDL=Location leads to a cross site scripting vulnerability (Stored). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.

The bug was discovered 08/03/2018. The weakness was presented 04/07/2019 as EasyIO 30P: CVE-2018-15820 (Stored XSS) and CVE-2018-15819 (Authentication bypass) as confirmed mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The public release was coordinated in cooperation with EasyIO. The identification of this vulnerability is CVE-2018-15820 since 08/23/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

After immediately, there has been an exploit disclosed. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 66 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:EASYIO30P-<session_token>/dev.htm it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.0.5.27 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

See VDB-133284 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• EasyIO

Name

• 30P

Version

• 2.0.5.0
• 2.0.5.1
• 2.0.5.2
• 2.0.5.3
• 2.0.5.4
• 2.0.5.5
• 2.0.5.6
• 2.0.5.7
• 2.0.5.8
• 2.0.5.9
• 2.0.5.10
• 2.0.5.11
• 2.0.5.12
• 2.0.5.13
• 2.0.5.14
• 2.0.5.15
• 2.0.5.16
• 2.0.5.17
• 2.0.5.18
• 2.0.5.19
• 2.0.5.20
• 2.0.5.21
• 2.0.5.22
• 2.0.5.23
• 2.0.5.24
• 2.0.5.25
• 2.0.5.26

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion