Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) DOM Based XSS

Title: Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) DOM Based XSS
Advisory ID: ZSL-2017-5406
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 03.05.2017
Summary
Serviio is a free media server. It allows you to stream your media files (music, video or images) to renderer devices (e.g. a TV set, Bluray player, games console or mobile phone) on your connected home network.
Description
The application is vulnerable to a DOM-based cross-site scripting. Data is read from document.location and passed to document.write() via the following statement in the response: document.write(''); This can be exploited to execute arbitrary HTML and script code in a user's browser DOM in context of an affected site.
Vendor
Petr Nejedly | Six Lines Ltd - http://www.serviio.org
Affected Version
1.8.0.0 PRO
1.7.1
1.7.0
1.6.1
Tested On
Restlet-Framework/2.2
Windows 7, UPnP/1.0 DLNADOC/1.50, Serviio/1.8
Mac OS X, UPnP/1.0 DLNADOC/1.50, Serviio/1.8
Linux, UPnP/1.0 DLNADOC/1.50, Serviio/1.8
Vendor Status
[12.12.2016] Vulnerability discovered.
[02.05.2017] Vendor communicated via Beyond Security's SecuriTeam Secure Disclosure program.
PoC
serviio_domxss.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] https://blogs.securiteam.com/index.php/archives/3094
[2] https://cxsecurity.com/issue/WLB-2017050020
[3] https://packetstormsecurity.com/files/142385
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/125647
Changelog
[03.05.2017] - Initial release
[05.05.2017] - Added reference [2] and [3]
[30.05.2017] - Added reference [4]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk