security bug, critical, Improper Access Control
VedranIteh opened this issue · comments
I need someone to confirm this for other systems/configurations.
It might be related to my heavily tweaked installation.
System:
Sentora 1.0.3.1 updated through years all the way from zpanel. PHP7 + snuffleupagus
Centos 6
Short desc:
Sentora user can change other users db users, email passwords etc. from there it is possible to progress to full account and database control.
Vuln desc:
"Email > Mailboxes", "Database > My SQL Users" module pulls user ID from the URL when EDIT button is clicked. supplying/guessing other users ids (id's are incremental not random) you get to change passwords for those users.
Logging into their emails you can easily request a password reset for various services, including sentora itself (if that email is used for access). Mysql module has the same type of vulnerabilty, revealing the db username too. From there it might be easy to crack down on the users web app. The bug is probably in every other edit button in Sentora.
Example:
https://example.com/?module=mysql_users&show=Edit&other=13
Solution:
- check for session id coincidence with submitted form id's
- check for session id coincidence with requested url id's
- randomize user ids, use alphanumeric ids
Hi VedranIteh,
I am the creator of the Sentora v1.0.3.1 PHP 7 upgrade code you are using.
I have checked and confirmed this is possible in the original v1.0.3 as well. This is a critical bug. I will check the other modules ASAP. I will patch my v1.0.3.1 ASAP. Great job finding this BUG
Sentora TEAM please check and confirm. Patch this right away for v1.0.3
@Dukecitysolutions thank you for clearing this up.
What kind of solution did you have in mind ? Need any help ?
@Dukecitysolutions thank you for clearing this up.
What kind of solution did you have in mind? Need any help?
Vedranlteh,
Help would be great. I agree with your solutions above.
- Verify MySQL user belongs to the logged-in user for EDITS.
- Change userid to random 5-10 letters to hide id in URL
I am trying to work on this and find a solution. let me know if you have any ideas.
Resolved in v2?
Fixed. Closing.