PT-2019-8659 · Vera · Veraedge+1

Published 2019-06-17 · Updated 2019-06-20 · CVE-2017-9390

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vera VeraEdge version 1.7.19 Vera Veralite version 1.7.481

Description An issue was discovered in the devices, where a shell script called connect.sh is used to return a specific cookie for the user when authenticated to https://home.getvera.com. The script retrieves a parameter called RedirectURL, but lacks strict input validation, allowing an attacker to execute client-side code on the application.

Recommendations For Vera VeraEdge version 1.7.19, consider disabling the connect.sh script until a patch is available. For Vera Veralite version 1.7.481, restrict access to the connect.sh script to minimize the risk of exploitation. Avoid using the RedirectURL parameter in the affected application until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9390

Affected Products

Veraedge

Veralite

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-9390 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9390 · Security Note
• https://t.me/cibsecurity/4958 · Telegram Post
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html · Note