HAWKI 1.0.0-beta.1 XSS / File Overwrite / Session Fixation

` SEC Consult Vulnerability Lab Security Advisory < 20240527-0 >  
=======================================================================  
title: Multiple vulnerabilities  
product: HAWKI (Interaction Design Team at the University of Applied  
Sciences and Arts in Hildesheim/Germany)  
vulnerable version: 1.0.0-beta.1, versions before commit 146967f  
fixed version: Github commit 146967f  
CVE number: CVE-2024-25975, CVE-2024-25976, CVE-2024-25977  
impact: high  
homepage: https://github.com/HAWK-Digital-Environments/HAWKI  
found: 2024-03-05  
by: Florian Stuhlmann (Office Bochum)  
Thorger Jansen (Office Bochum)  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"HAWKI is a didactic interface for universities based on the OpenAI API.  
It is not necessary for users to create an account, the university ID  
is sufficient for login - no user-related data is stored."  
  
Source: https://github.com/HAWK-Digital-Environments/HAWKI  
  
  
Business recommendation:  
------------------------  
The vendor provides a patch which should be installed immediately.  
  
SEC Consult highly recommends to perform a thorough security review of the  
product conducted by security professionals to identify and resolve potential  
further security issues.  
  
  
Vulnerability overview/description:  
-----------------------------------  
1) Arbitrary File Overwrite (CVE-2024-25975)  
The application implements an up- and downvote function which alters a  
value within a JSON file. The POST parameters are not filtered properly  
and therefore an arbitrary file can be overwritten. The file can be  
controlled by an authenticated attacker, the content cannot be controlled.  
It is possible to overwrite all files for which the webserver has write access.  
It is required to supply a relative path (path traversal).  
  
2) Reflected Cross-Site-Scripting (CVE-2024-25976)  
When LDAP authentication is activated in the configuration it is possible  
to obtain reflected XSS execution by creating a custom URL that the  
victim only needs to open in order to execute arbitrary JavaScript code in  
the victim's browser.  
  
3) Session Fixation (CVE-2024-25977)  
The application does not change the session token when using the login or  
logout functionality. An attacker can set a session token in the victim's  
browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect  
to the login page). This results in the victim's account being taken over.  
  
  
Proof of concept:  
-----------------  
1) Arbitrary File Overwrite (CVE-2024-25975)  
The following POST request can overwrite the file "AvatarFinanzen.png". This  
file is a default file located within the "img" folder.  
  
---  
POST /downvote.php HTTP/2  
Host: $host  
Cookie: PHPSESSID=<Session Id>  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 25  
  
../img/AvatarFinanzen.png  
---  
  
Both upvote.php and downvote.php are vulnerable. The vulnerable part in  
downvote.php is:  
  
---  
[...]  
$id = file_get_contents("php://input");  
$sanitizedId = htmlspecialchars($id, ENT_QUOTES, 'UTF-8');  
$file = "feedback/" . $sanitizedId;  
[...]  
file_put_contents("feedback/$sanitizedId", json_encode($json));  
[...]  
---  
  
  
2) Reflected Cross-Site-Scripting (XSS) (CVE-2024-25976)  
A call to the following URL will trigger an alertbox:  
  
---  
https://$host/HAWKI/login.php/"><script>alert(document.cookie)</script>  
---  
  
This is due to a fault in the file login.php where the content of  
"$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence  
the attacker does not need a valid account in order to exploit this issue  
The following code is vulnerable:  
  
---  
[...]  
$server = $_SERVER['PHP_SELF'];  
[...]  
echo '<form action = "' . $server . '" class="column" method = "post" >  
[...]  
---  
  
The vulnerability is exploitable with the Apache2 default configuration.  
For other webservers, the vulnerability might not be exploitable.  
  
  
3) Session Fixation (CVE-2024-25977)  
The attacker changes the value of PHPSESSID within the victim's browser to  
something like "abc". An attacker with the same value for PHPSESSID is now  
authenticated as well after the victim uses successfully logs in.  
  
  
Vulnerable / tested versions:  
-----------------------------  
The following version has been tested which was the latest version available  
at the time of the test:  
* 1.0.0-beta.1  
  
  
Vendor contact timeline:  
------------------------  
2024-03-21: Contacting vendor through email referenced on Github  
2024-03-22: Asking about email encryption, sending report unencrypted  
as requested.  
2024-04-17: Asked the vendor again to receive details regarding the timeline.  
2024-04-18: Vendor provides a patch pushed to the public repository.  
2024-05: Fix verification phase.  
2024-05-27: Release of security advisory.  
  
  
Solution:  
---------  
The vendor provides a patch which can be downloaded from  
https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1  
  
  
Workaround:  
-----------  
No workaround available.  
  
  
Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF Florian Stuhlmann & Thorger Jansen / @2024  
`