发布 2015-03-17 漏洞条目

Metasploit Project < 4.11.1 - Initial User Creation Cross-Site Request Forgery (Metasploit)

Exploit Source

# Exploit Title: Metasploit Project initial User Creation CSRF

# Google Dork: N/A

# Date: 14-2-2015

# Exploit Author: Mohamed Abdelbaset Elnoby (@SymbianSyMoh)

# Vendor Homepage: http://www.metasploit.com/

# Software Link:

http://www.rapid7.com/products/metasploit/editions-and-features.jsp

# Version: Free/Pro < 4.11.1 (Update 2015021901)

# Tested on: All OS

# CVE : N/A

Vulnerability:

Cross Site Request Forgery - (CSRF)

Info:

http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

More Details:

After doing some research, i have found that the anti csrf token

"authenticity_token" value is not validated from the local server side

which will result in a more csrf attack scenario around the whole local

metasploit project.

Affected URL(s)/PoC Code(s):

-Change Local Metasploit Project User Settings

<html>

<body>

</form>

</body>

</html>

-Full Local Metasploit Project Account Takeover before setting up the first

user settings

<html>

<body>

<input type="hidden" name="user[password_confirmation]"

value="PASSWORD" />

</form>

</body>

</html>

More Details/Impact:

-Change Local Metasploit Project User Settings

-Full Local Metasploit Project Account Takeover before setting up the first

user settings

Report Timeline:

[-] 14/02/2015: Reported to Rapid7 Security Team

[-] 14/02/2015: Initial Reply from HD Moore acknowledging the vulnerability

[-] 17/02/2015: Reply from "Eray Yilmaz" about the Operation and public

disclosure rules

[-] 20/02/2015: Reply from "Eray Yilmaz" about releasing a patch for the

vulnerability in place, Fixed in Update 4.11.1 (Update 2015021901),

https://community.rapid7.com/docs/DOC-3010

[-] 16/03/2015: Public Disclosure

Thanks

*Best Regards**,**,*

*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist

& Bug Bounty Hunter.

<https://www.linkedin.com/in/symbiansymoh>Curriculum Vitae

<http://goo.gl/cNrVpL>

<https://www.linkedin.com/in/symbiansymoh>Facebook

<https://fb.com/symbiansymoh>Twitter

<https://twitter.com/symbiansymoh>

作者: Mohamed Abdelbaset Elnoby
日期: 2015-03-17
类别: webapps
平台: multiple

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection