[CVE-2018-10091] Stored XSS vulnerabilities in AudioCode IP phones

Description

The AudioCodes 400HD series of IP phones is a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and contact center markets.

Most of user inputs in the CGI interface are not protected against XSS injections.

These vulnerabilities have only been tested on the 420HD phone.

Vulnerability records

CVE ID: CVE-2018-10091

Access Vector: remote

Security Risk: medium

Vulnerability: CWE-79

CVSS Base Score: 5.5

CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N/E:H/RC:C

Details

The script mainform.cgi is vulnerable to multiple stored XSS vulnerabilities.

For example, it is possible to add the following string :

<script>alert("XSS")</script> 

within any field (Name, Office, Home or Mobile) on the Directory page (used to add contacts). This will trigger JavaScript code execution in the web browser.

The payload gets stored and remains active in the page.

All forms on the web application, where the user input is printed on the page, seem to be vulnerable.

Note that the vulnerable page is only available to authenticated users (in possession of the admin configuration password).

Timeline (dd/mm/yyyy)

• 06/03/2018 : Initial discovery
• 17/04/2018 : Vendor contact
• 17/05/2018 : Vendor technical team acknowledgment
• 15/08/2018 : Vendor submit a private 2.2.16.128 prerelease that, according to our test, did not mitigate the issue.
• 10/01/2019 : Public disclosure

Fixes

AudioCodes allegedly fixed the issue in version 2.2.16.128.

Affected versions

Theses vulnerabilities have only been tested on the 420HD phone (firmware version: 2.2.12.126).

Credits

a.baube at sysdream dot com