Lucene search

K
exploitdbPongtorn AngsuchotmeteeEDB-ID:47123
HistoryJul 16, 2019 - 12:00 a.m.

CentOS Control Web Panel 0.9.8.836 - Authentication Bypass

2019-07-1600:00:00
Pongtorn Angsuchotmetee
www.exploit-db.com
86

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.03 Low

EPSS

Percentile

90.9%

# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.847 Bypass Login
# Date: 6 July 2019
# Exploit Author: Pongtorn Angsuchotmetee
# Vendor Homepage: https://control-webpanel.com/changelog
# Software Link: Not available, user panel only available for latest version
# Version: 0.9.8.836 to 0.9.8.846
# Tested on: CentOS 7.6.1810 (Core)
# CVE : CVE-2019-13360, CVE-2019-13605

# ====================================================================
# Information
# ====================================================================

Product             : CWP Control Web Panel
Vulnerability Name  : User panel bypass Login
version             : 0.9.8.836
Fixed on            : 0.9.8.848
Test on             : CentOS 7.6.1810 (Core)
Reference           : http://centos-webpanel.com/
                    : https://control-webpanel.com/changelog
CVE-Number          : CVE-2019-13605


# ====================================================================
# Root course of the vulnerability
# ====================================================================
After login success, the application will retuens base64 value and use it to authenticate again,
That allow attacker to modify the response and become a user

# ====================================================================
# Response format (version 0.9.8.836 to 0.9.8.837)
# ====================================================================

<username>||/<username>/theme/original



# CVE-2019-13360
# ====================================================================
# Steps to Reproduce Version 0.9.8.836 to 0.9.8.837
# ====================================================================

1. Login with valid username and invalid password
2. Replace the target username in "<username>||/<username>/theme/original"
3. Convert to base64
4. Place the base64 value to HTTP response body
5. Gain access to user area


# CVE-2019-13605
# ====================================================================
# Steps to Reproduce Version 0.9.8.838 to 0.9.8.846
# ====================================================================

1. Create a testing environment
	1.1 Create user as a target username
	1.2 Login as the user
	1.3 Save the HTTP response body (token value)
2. Login to the real target with valid username and invalid password
3. Place the value we saved from step 1.3 in HTTP response body
4. Gain access to user area

*The response value format is depends on version, just replace the hole value



# ====================================================================
# PoC
# ====================================================================
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13360.md
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md



# ====================================================================
# Timeline
# ====================================================================
2019-07-07: Discovered the bug
2019-07-07: Reported to vendor
2019-07-07: Vender accepted the vulnerability
2019-07-11: The vulnerability has been fixed
2019-07-15: Advisory published



# ====================================================================
# Discovered by
# ====================================================================
Pongtorn Angsuchotmetee

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.03 Low

EPSS

Percentile

90.9%