A vulnerability has been discovered in IceCMS version 2..1 (CVE-2023-36100), which allows attackers to escalate their privileges and gain access to sensitive information. This vulnerability is present due to improper input validation of the UserID parameter in the api/User/ChangeUser endpoint. This post will discuss the details of the vulnerability, including a code snippet, original references, and the exploit details.

Vulnerability Details

IceCMS version 2..1 does not properly validate user input when processing requests to change user settings in the api/User/ChangeUser endpoint. By manipulating the UserID parameter, attackers can escalate their privileges and gain access to sensitive information from other user accounts.

The following code snippet is an example of a vulnerable function in IceCMS 2..1

@api.route('/User/ChangeUser', methods=['PUT'])
def change_user():
    token = request.headers.get("Authorization")
    user_id = request.form.get("UserID")
    new_password = request.form.get("NewPassword")
    new_email = request.form.get("NewEmail")

    if token and user_id:
        user = User.query.filter(User.id == user_id).first()
        if user and user.verify_password(token):
            if new_password:
                user.password = generate_password_hash(new_password)
            if new_email:
                user.email = new_email
            db.session.commit()
            return jsonify({"status": "success"})
    return jsonify({"status": "error"})

As illustrated in the code snippet, the server accepts a request with a user ID and an authorization token. It then tries to find a user with the submitted ID and verifies that the token matches the user's password. If everything checks out, the password and/or email are updated accordingly.

The problem here is that there's no proper input validation for the user ID, and the authorization token doesn't provide enough protection. As a result, an attacker can craft a malicious request with a different user ID and matching password hash to escalate privileges or gain access to sensitive information from another user.

Exploit Details

To exploit this vulnerability, an attacker must first obtain a valid password hash for the target user. This can be done using various methods, such as password reuse attacks, social engineering, or other vulnerabilities in the system.

Once the attacker has acquired the password hash, they can craft a request to the api/User/ChangeUser endpoint with their target's user ID and the obtained hash as the authorization token, along with the new password or email:

PUT /api/User/ChangeUser HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Authorization: < Obtained Password Hash >

UserID=< Target User ID >&NewPassword=< Desired New Password >&NewEmail=< Desired New Email >

If the submitted request is successful, this will update the target user's password and/or email, effectively escalating the attacker's privileges and gaining access to sensitive information.

Recommendations

To secure your IceCMS 2..1 installation against this vulnerability, make sure to update to the latest version or apply any available patches. Additionally, developers should implement proper input validation for the user ID and use better authentication mechanisms that don't solely rely on password hashes, such as JWT tokens or OAuth.

Original References

- CVE-2023-36100 - National Vulnerability Database
- IceCMS GitHub Repository

Conclusion

Improper input validation can have serious consequences, as demonstrated by the privilege escalation vulnerability in IceCMS 2..1. By exploiting CVE-2023-36100, attackers can gain unauthorized access to sensitive information and pose severe risks to affected systems. Therefore, it is crucial to keep software up-to-date and apply best practices when handling user input and authentication.

Timeline

Published on: 09/01/2023 16:15:00 UTC
Last modified on: 09/07/2023 18:16:00 UTC