← Advisories

Teradek Slice 7.3.15 CSRF Change Password Exploit

Medium
Advisory ID
ZSL-2018-5467
Release Date
21 May 2018
Vendor
Teradek, LLC - https://www.teradek.com
Affected Version
Firmware Version:7.3.15 (build 31735), Hardware Version: 2.1
CVE
CVE-2018-25155
Tested On
lighttpd/1.4.48, lighttpd/1.4.31
Summary

Built on the award-winning Cube platform, Slice is a rack mount HEVC / H.264 codec designed to fit seamlessly into your broadcast studio. Like the Cube, Slice encoders and decoders includes 3G-SDI and HDMI I/O, Ethernet and WiFi connectivity, and full duplex IFB.

Description

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

Proof of Concept
teradek_slice_csrf.htmlTXT
Disclosure Timeline
02.03.2018Vulnerability discovered.
08.05.2018Vendor contacted.
08.05.2018Vendor replied asking more details.
08.05.2018Sent details to the vendor.
10.05.2018Asked vendor for status update.
13.05.2018No response from the vendor.
14.05.2018Asked vendor for status update.
20.05.2018No response from the vendor.
21.05.2018Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]https://www.exploit-db.com/exploits/44676/
[2]https://exchange.xforce.ibmcloud.com/vulnerabilities/143726
[3]https://packetstormsecurity.com/files/147795
[4]https://cxsecurity.com/issue/WLB-2018050176
[5]https://www.cve.org/CVERecord?id=CVE-2018-25155
Changelog
21.05.2018Initial release
29.05.2018Added reference [1], [2], [3] and [4]
23.03.2026Added reference [5]