Advertisement






CentOS Control Web Panel 0.9.8.836 Authentication Bypass

CVE Category Price Severity
CVE-2019-13360 CWE-287 Not listed High
Author Risk Exploitation Type Date
Unknown High Remote 2019-07-17
CPE
cpe:cpe:/a:centos:centos_control_web_panel:0.9.8.836
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019070083

Below is a copy:

CentOS Control Web Panel 0.9.8.836 Authentication Bypass
# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.847 Bypass Login
# Date: 6 July 2019
# Exploit Author: Pongtorn Angsuchotmetee
# Vendor Homepage: https://control-webpanel.com/changelog
# Software Link: Not available, user panel only available for latest version
# Version: 0.9.8.836 to 0.9.8.846
# Tested on: CentOS 7.6.1810 (Core)
# CVE : CVE-2019-13360, CVE-2019-13605

# ====================================================================
# Information
# ====================================================================

Product             : CWP Control Web Panel
Vulnerability Name  : User panel bypass Login
version             : 0.9.8.836
Fixed on            : 0.9.8.848
Test on             : CentOS 7.6.1810 (Core)
Reference           : http://centos-webpanel.com/
                    : https://control-webpanel.com/changelog
CVE-Number          : CVE-2019-13605


# ====================================================================
# Root course of the vulnerability
# ====================================================================
After login success, the application will retuens base64 value and use it to authenticate again,
That allow attacker to modify the response and become a user

# ====================================================================
# Response format (version 0.9.8.836 to 0.9.8.837)
# ====================================================================

<username>||/<username>/theme/original



# CVE-2019-13360
# ====================================================================
# Steps to Reproduce Version 0.9.8.836 to 0.9.8.837
# ====================================================================

1. Login with valid username and invalid password
2. Replace the target username in "<username>||/<username>/theme/original"
3. Convert to base64
4. Place the base64 value to HTTP response body
5. Gain access to user area


# CVE-2019-13605
# ====================================================================
# Steps to Reproduce Version 0.9.8.838 to 0.9.8.846
# ====================================================================

1. Create a testing environment
1.1 Create user as a target username
1.2 Login as the user
1.3 Save the HTTP response body (token value)
2. Login to the real target with valid username and invalid password
3. Place the value we saved from step 1.3 in HTTP response body
4. Gain access to user area

*The response value format is depends on version, just replace the hole value



# ====================================================================
# PoC
# ====================================================================
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13360.md
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md



# ====================================================================
# Timeline
# ====================================================================
2019-07-07: Discovered the bug
2019-07-07: Reported to vendor
2019-07-07: Vender accepted the vulnerability
2019-07-11: The vulnerability has been fixed
2019-07-15: Advisory published



# ====================================================================
# Discovered by
# ====================================================================
Pongtorn Angsuchotmetee

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.