{"id":389,"date":"2021-01-16T10:19:50","date_gmt":"2021-01-16T10:19:50","guid":{"rendered":"https:\/\/lyhinslab.org\/?p=389"},"modified":"2021-05-13T16:09:31","modified_gmt":"2021-05-13T16:09:31","slug":"how-the-white-box-hacking-works-scipio-erp-rce-csrf-and-co","status":"publish","type":"post","link":"https:\/\/lscp.llc\/index.php\/2021\/01\/16\/how-the-white-box-hacking-works-scipio-erp-rce-csrf-and-co\/","title":{"rendered":"How White-Box hacking works: Scipio ERP, RCE\/CSRF and Co"},"content":{"rendered":"\n<p>Why Scipio ERP (v2.0.0):<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>240 stars on Github<\/li><li>Apache-2.0 License<\/li><li>Java<\/li><\/ul>\n\n\n\n<p>The mentioned vulnerabilities were found and exploited by Ihor Voschyk and Darina Honcharenko, October 24, 2020. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Remote Code Execution<\/h3>\n\n\n\n<p>Severity: Critical<br>CVSS:3.0\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H<br>To reproduce the issue, navigate to \/admin\/control\/ProgramExport and paste a groovy script to execute any code on the server.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1155\" height=\"575\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-8.png\" alt=\"\" class=\"wp-image-401\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"552\" height=\"134\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-1.png\" alt=\"\" class=\"wp-image-393\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Local File Disclosure<\/h3>\n\n\n\n<p>Severity: High<br>CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:N\/A:N<\/p>\n\n\n\n<p>Navigate to \/cms\/control\/editTemplate and create a template:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"585\" height=\"388\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-2.png\" alt=\"\" class=\"wp-image-394\"\/><\/figure>\n\n\n\n<p>Then use <a href=\"file:\/\/..\/..\/..\/..\/any\/file\">file:\/\/..\/..\/..\/..\/any\/file<\/a> as a template location and press \u201cSave\u201d on the top:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"602\" height=\"380\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-3.png\" alt=\"\" class=\"wp-image-395\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"602\" height=\"406\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-4.png\" alt=\"\" class=\"wp-image-396\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Arbitrary File Deletion<\/h3>\n\n\n\n<p>Severity: Medium<br>CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:N\/I:L\/A:N<\/p>\n\n\n\n<p>Go to \/cms\/control\/CmsDataExport. Set the file name to override in &#8220;Single Filename&#8221; field, select any preset and press \u201cexport\u201d.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"602\" height=\"363\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-6.png\" alt=\"\" class=\"wp-image-398\"\/><\/figure>\n\n\n\n<p>The file will be overwritten with XML:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"348\" height=\"116\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/01\/image-7.png\" alt=\"\" class=\"wp-image-399\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">User enumeration<\/h3>\n\n\n\n<p>Severity: Medium<br>CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N<br>The application responds with a &#8220;user not found&#8221; message if a user does not exist. This makes guessing of correct logins possible.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Authorization Bypass (Cross-Site Request Forgery)<\/h3>\n\n\n\n<p>Severity: Medium<br>CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:N\/I:L\/A:N<\/p>\n\n\n\n<p>The application does not use any means of anti-CSRF protection, which means it&#8217;s possible to lure users to arbitrary pages and take action on legitimate&nbsp;Scipio&nbsp;ERP applications on their behalf. We were able to achieve RCE through CSRF vulnerability, thus effectively bypassing the authorization.  <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Conclusion<\/h3>\n\n\n\n<p>The overall security level of Scipio ERP application v2.0.0 is determined as: Low. <\/p>\n\n\n\n<p>Users should be aware that Scipio_ERP team acknowledged the User Enumeration vulnerability only. Risk of other vulnerabilites was accepted &#8211; &#8220;All but one of the security vulnerabilities are by design&#8221;. <\/p>\n\n\n\n<p><em>LL advises to all the researchers do not break real applications<\/em>&nbsp;<em>illegally. This fun leads to broken businesses and lives, and, most likely, will not make an attacker really rich.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Why Scipio ERP (v2.0.0): 240 stars on Github Apache-2.0 License Java The mentioned vulnerabilities were found and exploited by Ihor Voschyk [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-389","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/posts\/389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/comments?post=389"}],"version-history":[{"count":0,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/posts\/389\/revisions"}],"wp:attachment":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/media?parent=389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/categories?post=389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/tags?post=389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}