CVE-2014-8773 : Detail

CVE-2014-8773

Cross-Site Request Forgery - CSRF
A01-Broken Access Control
0.16%V3
Network
2014-12-03
17h00 +00:00
2014-12-03
16h57 +00:00
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Exploit information

Exploit Database EDB-ID : 35159

Publication date : 2014-11-04 23h00 +00:00
Author : Narendra Bhati
EDB Verified : No

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Version(s): 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 [without technical details] Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type: CSRF Tokens Bypass + Reflected Cross Site Scripting + Stored XSS CVE Reference: Requested Risk Level: Critical Solution Status: Fixed by Vendor Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) Patch - Upgrade to MODX Revolution 2.2.15. Due to the nature of this issue and the number of files requiring changes the solution is to upgrade. No installable patch or fileset is available for prior versions Reported By - Narendra Bhati ( R00t Sh3ll) Security Analyst @ Suma Soft Pvt. Ltd. , Pune ( India )IT Risk & Security Management Services , Pune ( India) Facebook - https://facebook.com/narendradewsoft twitter - https://www.twitter.com/NarendraBhatiNB Blog - http://hacktivity.websecgeeks.com Email - bhati.contact@gmail.com ----------------------------------------------------------------------------------------------- Advisory Details: Narendra Bhati discovered vulnerability in MODX Revolution, which can be exploited to perform Cross-Site Scripting (XSS) attacks & Along With Bypassing CSRF Tokens Protection ,Its allow an attacker to perform A CSRF Attack alosing With XSS to take over victim account by changin promary email address , Sending forged request Etc , Tricking an admin to attack on their own users by sending specially crafter malicous payload as CSRF Attack 1) Cross Site Request Forgery Protection (CSRF) Tokens Bypassing in Modx Revolution The vulnerability exists due to insufficient validation of csrftokens ["HTTP_MODHAUTH] at server side which allow an attacker to Perform CSRF Attack by bypassing CSRF Protection Mechanism To take over victim account , Trick him to send malicious request Etc. ------------------------------------------------------------------------------------ 2) Reflected Cross-Site Scripting (XSS) in MODX Revolution The vulnerability exists due to insufficient sanitization of input data passed via the "context_key" HTTP GET parameter to "http://127.0.0.1/day/modx/manager/index.php?a=55&class_key=modStaticResource&context_key=" URL. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. This vulnerability can be used against website administrator to perform phishing attacks, steal potentially sensitive data and gain complete control over web application. The exploitation example below uses the ""></script><img src=x onerror=prompt(/XSS/)>" JavaScript function to display "/XSS/" word: Vulnerable URL - http://127.0.0.1/day/modx/manager/index.php?a=55&class_key=modStaticResource&context_key="></script><img src=x onerror=prompt(/XSS/)> Vulnerable Parameter - "context_key" XSS Payload - "></script><img src=x onerror=prompt(/XSS/)> "></script><img src=x onerror=prompt(document.cookie)> ----------------------------------------------------------------------------------------------- 3) Stored Cross-Site Scripting (XSS) in MODX Revolution The vulnerability exists due to insufficient sanitization of input data passed via the "context" HTTP POST parameter to " http://127.0.0.1/day/modx/manager/index.php?id=1" URL. A local attacker [Authenticated User] can execute arbitrary HTML and script code in browser in context of the vulnerable website. This vulnerability can be used against website visitors to perform phishing attacks, steal potentially sensitive data and gain complete control over web application. The exploitation example below uses the "<script>alert(1)</script>" JavaScript function to display "1" word: Vulnerable URL - http://127.0.0.1/day/modx/manager/index.php?id=1 Vulnerable Parameter - "context" XSS Payload - <script>alert(1)</script> Note - This Stored XSS Was more critical because there was a CSRF protection vulnerability also , which allow an attacker to trick an administrator To Send Unwated Request for Stored XSS , which will directly attack to the Visitors , ----------------------------------------------------------------------------------------------- Solution: Upgrade to MODX Revolution 2.2.15. Due to the nature of this issue and the number of files requiring changes the solution is to upgrade. No installable patch or fileset is available for prior versions More Information: Public Advisory By Vendor :- http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior Public Disclosure With Tecnical Details - http://hacktivity.websecgeeks.com/modx-csrf-and-xss/ -----------------------------------------------------------------------------------------------

Products Mentioned

Configuraton 0

Modx>>Modx_revolution >> Version 2.0.0

Modx>>Modx_revolution >> Version 2.0.1

Modx>>Modx_revolution >> Version 2.0.3

Modx>>Modx_revolution >> Version 2.0.4

Modx>>Modx_revolution >> Version 2.0.5

Modx>>Modx_revolution >> Version 2.0.6

Modx>>Modx_revolution >> Version 2.0.7

Modx>>Modx_revolution >> Version 2.0.8

Modx>>Modx_revolution >> Version 2.1.0

Modx>>Modx_revolution >> Version 2.1.1

Modx>>Modx_revolution >> Version 2.1.2

Modx>>Modx_revolution >> Version 2.1.3

Modx>>Modx_revolution >> Version 2.1.4

Modx>>Modx_revolution >> Version 2.1.5

Modx>>Modx_revolution >> Version 2.2.0

Modx>>Modx_revolution >> Version 2.2.1

Modx>>Modx_revolution >> Version 2.2.2

Modx>>Modx_revolution >> Version 2.2.3

Modx>>Modx_revolution >> Version 2.2.4

Modx>>Modx_revolution >> Version 2.2.5

Modx>>Modx_revolution >> Version 2.2.6

Modx>>Modx_revolution >> Version 2.2.7

Modx>>Modx_revolution >> Version 2.2.8

Modx>>Modx_revolution >> Version 2.2.9

Modx>>Modx_revolution >> Version 2.2.10

Modx>>Modx_revolution >> Version 2.2.11

Modx>>Modx_revolution >> Version 2.2.12

Modx>>Modx_revolution >> Version 2.2.13

Modx>>Modx_revolution >> Version 2.2.14

References