29 lines
No EOL
1,003 B
Text
29 lines
No EOL
1,003 B
Text
# Exploit Title: Access and read and create vendor / API credentials in plaintext
|
||
# Date: 3/29/2017
|
||
# Exploit Author: Pesach Zirkind
|
||
# Vendor Homepage: https://personifycorp.com/
|
||
# Version: 7.5.2 - 7.6.1
|
||
# Tested on: Windows (all versions)
|
||
# CVE : CVE-2017-7312
|
||
|
||
# Category: webapps
|
||
|
||
1. Description
|
||
|
||
Any website visitor can access a page that allows viewing and creating any vendor accounts and their credentials including all applications that use Personify API's
|
||
|
||
It will show username, password and block(api password)
|
||
|
||
New accounts can be created, or, existing accounts can be used to spoof the origin of attacker.
|
||
|
||
Additionally, roles can be modified for existing vendors
|
||
|
||
2. Proof of Concept
|
||
|
||
Visit: http://site.com/Default.aspx?tabId=275
|
||
Click: Vendor Management on the left side
|
||
Click on the vendor you wish to edit
|
||
|
||
3. Solution:
|
||
|
||
The fix is available at Personify’s SFTP site (sftp.personifycorp.com) as Personify Patch – SSO-IMS-DNN-Permission.zip |