CentOS Control Web Panel 0.9.8.836 Authentication Bypass

`# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.847 Bypass Login  
# Date: 6 July 2019  
# Exploit Author: Pongtorn Angsuchotmetee  
# Vendor Homepage: https://control-webpanel.com/changelog  
# Software Link: Not available, user panel only available for latest version  
# Version: 0.9.8.836 to 0.9.8.846  
# Tested on: CentOS 7.6.1810 (Core)  
# CVE : CVE-2019-13360, CVE-2019-13605  
  
# ====================================================================  
# Information  
# ====================================================================  
  
Product : CWP Control Web Panel  
Vulnerability Name : User panel bypass Login  
version : 0.9.8.836  
Fixed on : 0.9.8.848  
Test on : CentOS 7.6.1810 (Core)  
Reference : http://centos-webpanel.com/  
: https://control-webpanel.com/changelog  
CVE-Number : CVE-2019-13605  
  
  
# ====================================================================  
# Root course of the vulnerability  
# ====================================================================  
After login success, the application will retuens base64 value and use it to authenticate again,  
That allow attacker to modify the response and become a user  
  
# ====================================================================  
# Response format (version 0.9.8.836 to 0.9.8.837)  
# ====================================================================  
  
<username>||/<username>/theme/original  
  
  
  
# CVE-2019-13360  
# ====================================================================  
# Steps to Reproduce Version 0.9.8.836 to 0.9.8.837  
# ====================================================================  
  
1. Login with valid username and invalid password  
2. Replace the target username in "<username>||/<username>/theme/original"  
3. Convert to base64  
4. Place the base64 value to HTTP response body  
5. Gain access to user area  
  
  
# CVE-2019-13605  
# ====================================================================  
# Steps to Reproduce Version 0.9.8.838 to 0.9.8.846  
# ====================================================================  
  
1. Create a testing environment  
1.1 Create user as a target username  
1.2 Login as the user  
1.3 Save the HTTP response body (token value)  
2. Login to the real target with valid username and invalid password  
3. Place the value we saved from step 1.3 in HTTP response body  
4. Gain access to user area  
  
*The response value format is depends on version, just replace the hole value  
  
  
  
# ====================================================================  
# PoC  
# ====================================================================  
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13360.md  
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md  
  
  
  
# ====================================================================  
# Timeline  
# ====================================================================  
2019-07-07: Discovered the bug  
2019-07-07: Reported to vendor  
2019-07-07: Vender accepted the vulnerability  
2019-07-11: The vulnerability has been fixed  
2019-07-15: Advisory published  
  
  
  
# ====================================================================  
# Discovered by  
# ====================================================================  
Pongtorn Angsuchotmetee  
`