Information Disclosure - Internal Path Disclosure (PHPWCMS) - CVE-2018-12990

Written by on
Hello All,

​INTRODUCTION

T​he purpose of this post is to let you know how I managed to get one more CVE​. Throughout this post, I will give you relevant examples/screenshots that demonstrates how I ended up finding the vulnerability.

​Alright, lets plunge into the Proof-Of-Concept !
​
PATH OF EXPLORATION
​
After submitting the first vulnerability (Stored Cross Site Scripting) to the developer for phpwcms application I continued to test further for finding more vulnerability. While testing I saw that CSRF Token was submitted in all the request. I tried to tamper with the parameter which contained the CSRF Token and found that the application throws an error which discloses the Internal Path of the application where it has been hosted.

THE MOST AWAITED DEEP DIVE POC​

 1) While submitting the profile page request I saw that the application passes one parameter (csrf_token_value) which as per the name suggest contains the csrf token as you can refer the below screenshot.
The CSRF Token was passed on mostly all pages in the application.



 2) I modified the last 2 numbers of csrf_token_value parameter and submitted the request to check if it validates the token.


3) After submitting the request application threw an error which contained Internal Path of the application where it has been hosted.


The vulnerability is still not fixed.

REFERENCE LINKS

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12990
https://nvd.nist.gov/vuln/detail/CVE-2018-12990
https://twitter.com/CVEnew/status/1013067248821587973
https://github.com/slackero/phpwcms/issues/243

DISCLOSURE DATELINES

23 October 2017 at 23:49 - Report send.
30 October 2017 at 11:10 - First reminder send.
22 February 2018 at 22:04 - Second reminder send and asked for disclosure.
22 February 2018 at 22:55 - Received the reply from the developer and he agreed for the disclosure and told that he will take some time for patching the same.
22 February 2018 at 23:07 - I replied saying that will wait for the finding to get fixed and asked for the timelines.
22 February 2018 at 23:11 - Received the reply from the developer and he told that he will be fixing it by end of April 2018.
22 February 2018 at 23:16 - Agreed on the developers reply and waited for the fix..
27 April 2018 at 15:50 - Send the reminder to developer asking for the status of the vulnerability if it was fixed.
29 April 2018 at 16:58 - Received the reply from the developer and he updated me saying that he will be fixing the vulnerability by mid of may.
29 April 2018 at 17:15 - Agreed on the developers reply and waited for the fix.
21 May 2018 at 14:22 - Send the reminder to developer asking for the status of the vulnerability if it was fixed.
01 June 2018 at 00:23 - Send the reminder to developer asking for the status of the vulnerability if it was fixed.
09 June 2018 at 19:01 - Send the reminder to developer asking for the status of the vulnerability if it was fixed.
28 June 2018 at 20:53 - Send the reminder to developer asking for the status of the vulnerability if it was fixed and intimated about full disclosure.
28 June 2018 at 21:31 - Request for the CVE ID to CVE Mitre.
29 June 2018 at 15:34 - CVE ID Received (CVE-2018-12990).

Thanks for reading the post.

Special Thanks to all my friends who helped / supported / motivated me for writing blogs. 🙏

Comments

Post a Comment

Popular posts from this blog

Process Injection - Part I

Written by on
Image
Hello All, After publishing the post about Dumping Process Memory with Custom C# Code my friend Himanshu suggested me to write a tool & a blog post about Process Injection for learning and he referenced his post about Code Injection which covers the concept about the vanilla process injection technique. It was quite interesting to learn and understand the core concepts about Process Injection techniques and as a learning path to code in c# leveraging Windows API I started writing the tool for Process Injection. What is Process Injection ? Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Why Process Injection ?
Read more

Introduction to Callidus

Written by on
Image
Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage
Read more

Exploring the Dark Side of Package Files and Storage Account Abuse

Written by on
Image
 Hello All, In this blog, we dive into the dark side of package files and Storage Account abuse within the Azure Function App service. We explore how package files can be leveraged to enhance the functionality of the Functions Apps, shedding light on the potential abuse of package files. By examining the connection between the Function App and Storage Account, we uncover how attackers can abuse the Storage Account's connection string to gain unauthorized access to the Function Apps. We will provide step-by-step insights into replacing binary files and deploying custom code, enabling attackers to take control of the Function App.  The research was jointly done by  Raunak and myself . What are Function Apps? Function Apps (Lambda in AWS) are serverless computing services provided by Azure Cloud. They allow developers to build and deploy small, functions that can be triggered by events such as simple HTTP request. Function Apps provide an environment for executing our code without th
Read more