Thrive Smart Home v1.1 Reflected Cross-Site Scripting

Title: Thrive Smart Home v1.1 Reflected Cross-Site Scripting
Advisory ID: ZSL-2019-5553
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 29.12.2019
Summary
As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options available to give your home a high-tech makeover. If the convenience of feeding your cat or turning on your air conditioning with a tap on your smartphone isn't enough of a reason to make the investment, consider how conveniently you can protect your home and belongings. From Wi-Fi-equipped smoke detectors to plugs with auto turn-offs, smart homes with their always-on connectivity and notifications systems allow consumers to quickly respond to the unexpected. For instance, if you install a smart water leak and moisture monitoring device, you can set up alerts on your phone for unusual changes in moisture and stop leaks before they cause major flooding or mold. It's a convenient way to proactively protect your home from costly damage, whether it's an overflowing laundry tub, a cracked washer hose, or a leaky water heater.
Description
Input passed to the GET parameter 'ip_data' is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
Vendor
Thrive - http://www.thrivesmarthomes.com
Affected Version
1.1
Tested On
Apache httpd 2.4.25 (Raspbian)
Vendor Status
N/A
PoC
thrivesmarthome_xss.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] https://packetstormsecurity.com/files/155796
[2] https://cxsecurity.com/issue/WLB-2019120133
[3] https://exchange.xforce.ibmcloud.com/vulnerabilities/173729
Changelog
[29.12.2019] - Initial release
[24.01.2020] - Added reference [1], [2] and [3]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk