Leica Geosystems GNSS Storage XSS via File Upload (ZSL-2019-5503)

Vulnerability Key Information Title: Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 JS/HTML Code Injection Advisory ID: ZSL-2019-5503 Type: Local/Remote Impact: Cross-Site Scripting (XSS) Risk: 3/5 Release Date: 05.01.2019 Summary Leica GR10 is the next-generation GNSS reference station receiver, combining advanced technology with a "plug-and-play" workflow. Designed for various GNSS reference station applications, the Leica GR10 offers new levels of simplicity, reliability, and performance. Description The application is affected by a stored XSS vulnerability. The issue is triggered via unrestricted file upload, allowing an attacker to upload HTML or JavaScript files, which are stored at . This can be exploited to execute arbitrary HTML and JavaScript code within the context of the affected site. Vendor Leica Geosystems AG - https://www.leica-geosystems.com Affected Versions 4.30.063 4.20.232 4.11.606 3.22.1818 3.10.1633 2.62.782 1.00.395 Test Environment BarracudaServer.com (WindowsCE) Vendor Status N/A Demonstration leica_xss.html Acknowledgments Vulnerability discovered by Gjoko Krstic - gjoko@zeroscience.mk References 1. https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5502.php 2. https://www.exploit-db.com/exploits/46091 3. https://packetstormsecurity.com/files/151041 4. https://exchange.xforce.ibmcloud.com/vulnerabilities/155274 Update History [05.01.2019] - Initial release [14.01.2019] - Added references [2], [3], and [4] Contact Zero Science Lab Website: http://www.zeroscience.mk Email: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

Leica Geosystems GNSS Storage XSS via File Upload (ZSL-2019-5503)