A reflected Cross-Site Scripting (XSS) vulnerability (CVE-2024-34923) has been discovered in the Avocent DSR203 Appliance firmware versions 03.04.00.07 and earlier, as well as the SVIP102 Appliance firmware versions 01.06.00.03 and earlier. We will explore the details of the vulnerability, how it can be exploited, and the available mitigations in this long read post. Before diving into the details, let's get familiar with the affected systems and reflect XSS attacks.

Affected Systems

1) Avocent DSR203 Appliance is a digital KVM (Keyboard, Video, and Mouse) Over IP appliance that provides secure access to local and remote systems. The firmware version 03.04.00.07 and earlier are affected.

Official Product Page: Avocent DSR203

2) SVIP102 Appliance is a Serial over IP solution that enables remote monitoring and management of serial devices. The firmware version 01.06.00.03 and earlier are affected.

Official Product Page: SVIP102

What is Reflected XSS?

Reflected XSS is a type of Cross-Site Scripting vulnerability where malicious scripts are injected into the trusted websites through user-provided input such as search queries, URL parameters, or form inputs. When a victim accesses this malicious URL, the injected script is executed by the victim's browser, leading to various malicious exploits such as cookie theft, data manipulation, or account takeover.

Exploit Details

In the identified vulnerability, the attacker can use the affected URL parameters to inject their XSS payload. Let's look at an example to understand how this exploit can be executed:

Vulnerable URL: http:///cgi-bin/vrq.cgi

Code Snippet: Assuming a vulnerable version of the firmware, the attacker can craft the following malicious URL:

http://<IP_Address>/cgi-bin/vrq.cgi?query=<script>alert("XSS")</script>;

When a victim clicks on the malicious URL, the XSS payload within the URL (in this case, a simple alert box) is executed by the victim's browser.

To remediate this vulnerability, users must update their firmware to the following versions or later

1) Avocent DSR203 Appliance: 03.07.01.23
2) SVIP102 Appliance: 01.07.00.00

Firmware Updates

1) Avocent DSR203 Appliance: Download Firmware Version 03.07.01.23

2) SVIP102 Appliance: Download Firmware Version 01.07.00.00

In addition to updating the firmware, it is recommended to implement Content Security Policy (CSP) headers to reduce the risk of XSS attacks. More information on CSP can be found at Mozilla Web Docs.

Conclusion

The CVE-2024-34923 reflected XSS vulnerability poses a significant threat to users of Avocent DSR203 and SVIP102 Appliances with firmware versions lower than the specified updates. To protect your systems from potential harm, upgrading the firmware and implementing Content Security Policy headers is highly recommended. Always stay vigilant and ensure your systems are regularly patched and up-to-date to minimize the risk of security vulnerabilities.

Timeline

Published on: 05/27/2024 20:15:09 UTC
Last modified on: 12/02/2024 18:15:09 UTC