CVE-2019-17590

** DISPUTED ** The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token values. A remote attacker can exploit this by crafting a malicious page and dispersing it to a victim via social engineering, enticing them to click the link. Once the user/victim clicks the "try again" button, the attacker can take over the account and perform unintended actions on the victim's behalf. NOTE: A third-party maintainer has stated that this CVE is a false report. They state that the csrf_callback function is actually a callback function to the callers own handler for output. The function called can be changed via configuration to a custom callback to handle failed validation differently. They also stated that there is no way for an attacker to change tokens to make them valid from the client side. The only thing an attack can do is to pull the token out of the javascript, but that will always be possible and has nothing to do with the callback.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://pastebin.com/01tDgq7u	Exploit Third Party Advisory
https://pastebin.com/01tDgq7u	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:csrf_magic_project:csrf_magic:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:32

Type	Values Removed	Values Added
References	~~() https://pastebin.com/01tDgq7u - Exploit, Third Party Advisory~~	() https://pastebin.com/01tDgq7u - Exploit, Third Party Advisory

Information

Published : 2019-11-26 18:15

Updated : 2024-11-21 04:32

NVD link : CVE-2019-17590

Mitre link : CVE-2019-17590

CVE.ORG link : CVE-2019-17590

JSON object : View

Products Affected

csrf_magic_project

csrf_magic

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2019-17590", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-11-26T18:15:15.663", "references": [{"url": "https://pastebin.com/01tDgq7u", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://pastebin.com/01tDgq7u", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token values. A remote attacker can exploit this by crafting a malicious page and dispersing it to a victim via social engineering, enticing them to click the link. Once the user/victim clicks the \"try again\" button, the attacker can take over the account and perform unintended actions on the victim's behalf. NOTE: A third-party maintainer has stated that this CVE is a false report. They state that the csrf_callback function is actually a callback function to the callers own handler for output. The function called can be changed via configuration to a custom callback to handle failed validation differently. They also stated that there is no way for an attacker to change tokens to make them valid from the client side. The only thing an attack can do is to pull the token out of the javascript, but that will always be possible and has nothing to do with the callback"}, {"lang": "es", "value": "** EN DISPUTA ** La funci\u00f3n csrf_callback en la biblioteca CSRF Magic hasta el 2016-03-27 es vulnerable a la omisi\u00f3n de la protecci\u00f3n CSRF ya que permite manipular los valores del token csrf. Un atacante remoto puede explotar esto creando una p\u00e1gina maliciosa y dispers\u00e1ndola a una v\u00edctima mediante ingenier\u00eda social, incit\u00e1ndoles a hacer clic en el enlace. Una vez que el usuario / v\u00edctima hace clic en el bot\u00f3n \"intentar de nuevo\", el atacante puede hacerse cargo de la cuenta y realizar acciones involuntarias en nombre de la v\u00edctima. NOTA: Un mantenedor externo ha declarado que este CVE es un informe falso. Afirman que la funci\u00f3n csrf_callback es en realidad una funci\u00f3n de devoluci\u00f3n de llamada para el manejador propio de la persona que llama para la salida. La funci\u00f3n llamada se puede cambiar a trav\u00e9s de la configuraci\u00f3n a una devoluci\u00f3n de llamada personalizada para manejar la validaci\u00f3n fallida de manera diferente. Tambi\u00e9n declararon que no hay forma de que un atacante cambie los tokens para que sean v\u00e1lidos desde el lado del cliente. Lo \u00fanico que puede hacer un ataque es extraer el token del javascript, pero eso siempre ser\u00e1 posible y no tiene nada que ver con la devoluci\u00f3n de llamada."}], "lastModified": "2024-11-21T04:32:35.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:csrf_magic_project:csrf_magic:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2B68842-425B-431E-A703-649189716DCA", "versionEndIncluding": "2016-03-27"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

8.8 /10