PT-2017-17642 · Contiki · Contiki Operating System

Alex Pop + 3 · Published 2017-05-28 · Updated 2017-06-06 · CVE-2017-7296

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contiki Operating System version 3.0

Description A Persistent XSS issue is present in the MQTT/IBM Cloud Config page of cc26xx-web-demo, which features a webserver running on a constrained device. This page allows users to remotely configure the device's operation by sending HTTP POST requests. The issue consists of improper input sanitization of the text fields on the MQTT/IBM Cloud config page, allowing for JavaScript code injection.

Recommendations For Contiki Operating System version 3.0, as a temporary workaround, consider disabling the MQTT/IBM Cloud Config page (aka mqtt.html) in the cc26xx-web-demo until a patch is available. Restrict access to the cc26xx-web-demo webserver to minimize the risk of exploitation. Avoid using the text fields on the MQTT/IBM Cloud config page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-7296

Affected Products

Contiki Operating System

References · 4

• https://osv.dev/vulnerability/CVE-2017-7296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7296 · Security Note
• https://gist.github.com/jackmcbride/c9328627f1ee104ce84f3fb7eff42f1e · Note
• http://securityfocus.com/bid/98790 · Note