ReQuest F3 Media Server Unauthenticated Debug Log Disclosure (ZSL-2020-5600)

Critical Vulnerability Information Title: ReQuest Serious Play F3 Media Server 7.0.3 Debug Log Disclosure Advisory ID: ZSL-2020-5600 Type: Local/Remote Impact: Exposure of System Information, Exposure of Sensitive Information Risk: (4/5) Release Date: 18.10.2020 Summary F3 packs all the power of ReQuest’s multi-zone Serious Play servers into a compact powerhouse. With the ability to add unlimited NAS devices, the F3 can handle your entire family’s media collection with ease. Description The unprotected web management server is vulnerable to a sensitive information disclosure vulnerability. An unauthenticated attacker can access the message_log page and disclose the webserver's Python debug log file, which contains system information, credentials, paths, processes, and command arguments running on the device. Vendor ReQuest Serious Play LLC - Affected Version 7.0.3.4968 (Pro) 7.0.2.4954 6.5.2.4954 6.4.2.4681 6.3.2.4203 2.0.1.823 Tested On ReQuest Serious Play® OS v7.0.1 ReQuest Serious Play® OS v6.0.0 Debian GNU/Linux 5.0 Linux 3.2.0-4-686-pae Linux 2.6.36-request+lenny.5 Apache/2.2.22 Apache/2.2.9 PHP/5.4.45 PHP/5.2.6-1 Vendor Status [01.08.2020] Vulnerability discovered. [16.08.2020] Vendor contacted. [17.10.2020] No response from the vendor. [18.10.2020] Public security advisory released. PoC Credits Vulnerability discovered by Gjoko Krstic - References [1] [2] [3]

Goal Reached Thanks to every supporter — we hit 100%!

ReQuest F3 Media Server Unauthenticated Debug Log Disclosure (ZSL-2020-5600)