### [CVE-2023-1384](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1384)
![](https://img.shields.io/static/v1?label=Product&message=Fire%20TV%20Stick%203rd%20gen&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=TV%20with%20FireOS%20&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%206.2.9.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%207.6.3.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-80%20Improper%20Neutralization%20of%20Script-Related%20HTML%20Tags%20in%20a%20Web%20Page%20(Basic%20XSS)&color=brighgreen)

### Description

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be runThis issue affects:Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.Insignia TV with FireOS versions prior to 7.6.3.3.

### POC

#### Reference
- https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/

#### Github
No PoCs found on GitHub currently.