Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)

Date: Thu Jan 03 2013 - 15:00:01 CST

Product: Nexpose Security Console
Vendor: Rapid7
Version: < 5.5.3
Tested Version: 5.5.1
Vendor Notified Date: December 19, 2012
Release Date: January 2, 2013
Risk: High
Authentication: None required
Remote: Yes

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose
Security Console 5.5.3 and below allow remote attackers to submit
actions on a legitimate userís behalf.
By not properly checking each URL, an attacker can execute requests on
behalf of a legitimate user.
If an authenticated user is tricked into visiting a specially crafted
page, it may be possible to perform user-initiated actions on the web
application using the victimís established session.
Successful exploitation of this vulnerability resulted in deleting scan
data and sites during the proof-of-concept.

Exploit steps for proof-of-concept:
1. Create an external site/page:
http://attackersite.com/nexpose-csrf.htm that contains:
   <!-- Nexpose CSRF PoC -->
method="POST" enctype="multipart/form-data">
       <input type="submit" value="delete site" />
       //document.forms[0].submit(); //uncomment to auto-submit
2. Lure victim to http://attackersite.com/nexpose-csrf.htm.
3. Site with ID 1 is deleted when form is submitted.

Vendor Notified: Yes
Vendor Response: Quickly escalated and resolved.
Vendor Update: Remediated in 5.5.4.


Robert Gilbert
HALOCK Security Labs