Yealink VOIP Phone persistent cross-site scripting defects and repair

Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability
Product: Yealink Easy VOIP Phone
Development Site: http://www.yealink.com/
By Narendra Shinde
========================================================== ==============
Developer introduction:
---------------------------
Yealink is the professional designer and manufacturer of IP Phone and IP Video Phone for the world-wide broadband telephony market. for more than ten years, Yealink has focused on VoIP products characterized by high cost-performance, easy deployment and affordable price.
Source: http://www.yealink.com/index.php/Company/
Defect information:
-----------------------------------
1) Multiple css Defects
Defects:
-------------------------------------
Class: Improper Neutralization of Input during Web Page Generation ('cross-site scripting') [CWE-79]
Impact: Insertion and Execution of malicious scripts in user browser
Remotely Exploitable: Yes
Authentication Required: Yes
User interaction Required: Yes
Vulnerability overview/description:
-------------------------------------------------
Yealink Easy Voip phone is prone to multiple cross-site scripting vulnerabilities as the user-supplied input parameter ed via certain parameters is not properly sanitized. this can be exploited by submitting specially crafted input to the affected software. successful exploitation cocould allow the attacker to execute arbitrary script code within the user's browser session in the security context of the targeted site. the attacker cocould redirect user to malicious site, gain access to user's cookies (including authentication cookies), if any, associated with the targeted site, access recently submitted data by the target user via web forms, or take actions on the site masquerading as the target user.
Description:
While adding contact information on Contacts page, user input is not properly sanitized.
The "name" field in Local Phone book and Blacklist form is vulnerable to script injection attacks.
Exploitation:
-Login using normal user (Default is user: user)
-Visit Contacts page at http: // www.2cto.com/cgi-bin/ConfigManApp.com? Id = 9
-Insert ">
Device use common contact page for normal user and Admin user. Therefore any malicous input from user account on Contact page direclty affects admin user.
Workaround:
------------------
-Filter all unnecessary special characters from user input
-Use character escaping and encoding
-For more details please refer:
Https://www.owasp.org/index.php/Cross-Site_Request_Forgery _ % 28 CSRF % 29_Prevention_Cheat_Sheet