SEC Consult Vulnerability Lab Security Advisory < 20240527-0 >

           title: Multiple vulnerabilities  
         product: HAWKI (Interaction Design Team at the University of Applied  
                  Sciences and Arts in Hildesheim/Germany)  

vulnerable version: 1.0.0-beta.1, versions before commit 146967f
fixed version: Github commit 146967f
CVE number: CVE-2024-25975, CVE-2024-25976, CVE-2024-25977
impact: high
homepage: https://github.com/HAWK-Digital-Environments/HAWKI
found: 2024-03-05
by: Florian Stuhlmann (Office Bochum)
Thorger Jansen (Office Bochum)
SEC Consult Vulnerability Lab

                  An integrated part of SEC Consult, an Eviden business  
                  Europe | Asia

                  https://www.sec-consult.com

=======================================================================

Vendor description:

“HAWKI is a didactic interface for universities based on the OpenAI API.
It is not necessary for users to create an account, the university ID
is sufficient for login - no user-related data is stored.”

Source: https://github.com/HAWK-Digital-Environments/HAWKI

Business recommendation:

The vendor provides a patch which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve potential
further security issues.

Vulnerability overview/description:

1. Arbitrary File Overwrite (CVE-2024-25975)
   The application implements an up- and downvote function which alters a
   value within a JSON file. The POST parameters are not filtered properly
   and therefore an arbitrary file can be overwritten. The file can be
   controlled by an authenticated attacker, the content cannot be controlled.
   It is possible to overwrite all files for which the webserver has write access.
   It is required to supply a relative path (path traversal).

2. Reflected Cross-Site-Scripting (CVE-2024-25976)
   When LDAP authentication is activated in the configuration it is possible
   to obtain reflected XSS execution by creating a custom URL that the
   victim only needs to open in order to execute arbitrary JavaScript code in
   the victim’s browser.

3. Session Fixation (CVE-2024-25977)
   The application does not change the session token when using the login or
   logout functionality. An attacker can set a session token in the victim’s
   browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect
   to the login page). This results in the victim’s account being taken over.

Proof of concept:

1. Arbitrary File Overwrite (CVE-2024-25975)
   The following POST request can overwrite the file "AvatarFinanzen.png". This
   file is a default file located within the “img” folder.

---

POST /downvote.php HTTP/2
Host: $host
Cookie: PHPSESSID=<Session Id>
Content-Type: application/x-www-form-urlencoded
Content-Length: 25

…/img/AvatarFinanzen.png

Both upvote.php and downvote.php are vulnerable. The vulnerable part in
downvote.php is:

---

[…]
$id = file_get_contents(“php://input”);
$sanitizedId = htmlspecialchars($id, ENT_QUOTES, ‘UTF-8’);
$file = “feedback/” . $sanitizedId;
[…]
file_put_contents("feedback/$sanitizedId", json_encode($json));
[…]

---

2. Reflected Cross-Site-Scripting (XSS) (CVE-2024-25976)
   A call to the following URL will trigger an alertbox:

---

https://$host/HAWKI/login.php/"><script>alert(document.cookie)</script>

This is due to a fault in the file login.php where the content of
"$_SERVER[‘PHP_SELF’]" is reflected into the HTML of the website. Hence
the attacker does not need a valid account in order to exploit this issue
The following code is vulnerable:

---

[…]
$server = $_SERVER[‘PHP_SELF’];
[…]
echo ‘<form action = "’ . $server . '" class="column" method = “post” >
[…]

---

The vulnerability is exploitable with the Apache2 default configuration.
For other webservers, the vulnerability might not be exploitable.

3. Session Fixation (CVE-2024-25977)
   The attacker changes the value of PHPSESSID within the victim’s browser to
   something like "abc". An attacker with the same value for PHPSESSID is now
   authenticated as well after the victim uses successfully logs in.

Vulnerable / tested versions:

The following version has been tested which was the latest version available
at the time of the test:

• 1.0.0-beta.1

Vendor contact timeline:

2024-03-21: Contacting vendor through email referenced on Github
2024-03-22: Asking about email encryption, sending report unencrypted
as requested.
2024-04-17: Asked the vendor again to receive details regarding the timeline.
2024-04-18: Vendor provides a patch pushed to the public repository.
2024-05: Fix verification phase.
2024-05-27: Release of security advisory.

Solution:

The vendor provides a patch which can be downloaded from
https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1

Workaround:

No workaround available.

Advisory URL:

https://sec-consult.com/vulnerability-lab/

SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia

About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.

Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/

Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult

EOF Florian Stuhlmann & Thorger Jansen / @2024