89 lines
No EOL
3.3 KiB
Text
89 lines
No EOL
3.3 KiB
Text
# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.847 Bypass Login
|
|
# Date: 6 July 2019
|
|
# Exploit Author: Pongtorn Angsuchotmetee
|
|
# Vendor Homepage: https://control-webpanel.com/changelog
|
|
# Software Link: Not available, user panel only available for latest version
|
|
# Version: 0.9.8.836 to 0.9.8.846
|
|
# Tested on: CentOS 7.6.1810 (Core)
|
|
# CVE : CVE-2019-13360, CVE-2019-13605
|
|
|
|
# ====================================================================
|
|
# Information
|
|
# ====================================================================
|
|
|
|
Product : CWP Control Web Panel
|
|
Vulnerability Name : User panel bypass Login
|
|
version : 0.9.8.836
|
|
Fixed on : 0.9.8.848
|
|
Test on : CentOS 7.6.1810 (Core)
|
|
Reference : http://centos-webpanel.com/
|
|
: https://control-webpanel.com/changelog
|
|
CVE-Number : CVE-2019-13605
|
|
|
|
|
|
# ====================================================================
|
|
# Root course of the vulnerability
|
|
# ====================================================================
|
|
After login success, the application will retuens base64 value and use it to authenticate again,
|
|
That allow attacker to modify the response and become a user
|
|
|
|
# ====================================================================
|
|
# Response format (version 0.9.8.836 to 0.9.8.837)
|
|
# ====================================================================
|
|
|
|
<username>||/<username>/theme/original
|
|
|
|
|
|
|
|
# CVE-2019-13360
|
|
# ====================================================================
|
|
# Steps to Reproduce Version 0.9.8.836 to 0.9.8.837
|
|
# ====================================================================
|
|
|
|
1. Login with valid username and invalid password
|
|
2. Replace the target username in "<username>||/<username>/theme/original"
|
|
3. Convert to base64
|
|
4. Place the base64 value to HTTP response body
|
|
5. Gain access to user area
|
|
|
|
|
|
# CVE-2019-13605
|
|
# ====================================================================
|
|
# Steps to Reproduce Version 0.9.8.838 to 0.9.8.846
|
|
# ====================================================================
|
|
|
|
1. Create a testing environment
|
|
1.1 Create user as a target username
|
|
1.2 Login as the user
|
|
1.3 Save the HTTP response body (token value)
|
|
2. Login to the real target with valid username and invalid password
|
|
3. Place the value we saved from step 1.3 in HTTP response body
|
|
4. Gain access to user area
|
|
|
|
*The response value format is depends on version, just replace the hole value
|
|
|
|
|
|
|
|
# ====================================================================
|
|
# PoC
|
|
# ====================================================================
|
|
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13360.md
|
|
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md
|
|
|
|
|
|
|
|
# ====================================================================
|
|
# Timeline
|
|
# ====================================================================
|
|
2019-07-07: Discovered the bug
|
|
2019-07-07: Reported to vendor
|
|
2019-07-07: Vender accepted the vulnerability
|
|
2019-07-11: The vulnerability has been fixed
|
|
2019-07-15: Advisory published
|
|
|
|
|
|
|
|
# ====================================================================
|
|
# Discovered by
|
|
# ====================================================================
|
|
Pongtorn Angsuchotmetee |