CVE-2018-17104 (published 2018-09-16T21:29Z)

An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Peter Ivanov
author_date: 2018-08-31 19:07:21+03:00
msg: fix of issue #484

editing user now requires csrf token
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: UserManager.php
change_type: ModificationType.MODIFY
diff: @@ -646,6 +646,7 @@ class UserManager
         }
 
         if (defined('MW_API_CALL')) {
+
             if (isset($params['is_admin']) and $this->is_admin() == false) {
                 unset($params['is_admin']);
             }
@@ -901,6 +902,21 @@ class UserManager
             }
         }
         if ($force == false) {
+
+            if (isset($params['id'])) {
+                $validate_token = mw()->user_manager->csrf_validate($params);
+
+                if ($validate_token == false) {
+
+                    return array(
+                        'error' => _e('Confirm edit of profile', true),
+                        'form_data_required' => 'token',
+                        'form_data_module' => 'users/profile/confirm_edit'
+                    );
+
+                }
+            }
+
             if (isset($params['id']) and $params['id'] != 0) {
                 $adm = $this->is_admin();
                 if ($adm == false) {
@@ -923,6 +939,9 @@ class UserManager
                             return array('error' => 'You must be logged save your settings');
                         }
                     } else {
+
+
+
                         if (!isset($params['id'])) {
                             $params['id'] = $this->id();
                         }

programming_language: PHP
filename: edit_user.php
change_type: ModificationType.MODIFY
diff: @@ -186,7 +186,8 @@ if (isset($data[0]) == false) {
     </span>
             <?php endif; ?>
         </div>
-        <input type="hidden" class="mw-ui-field" name="id" value="<?php print $data['id']; ?>">
+        <input type="hidden"   name="id" value="<?php print $data['id']; ?>">
+        <input type="hidden"   name="token" value="<?php print csrf_token() ?>"  autocomplete="off">
         <div>
             <table btos="0" cellpadding="0" cellspacing="0" class="mw-ui-table mw-ui-table-basic mw-admin-user-tab-content" width="100%">
                 <col width="150px"/>

programming_language: PHP
filename: confirm_edit.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,11 @@
+<div class="row" style="margin-top: 20px;margin-bottom: 20px;">
+    <div class="col-xs-12">
+        <div class="form-group">
+            <h5><?php _e('Confirm edit of profile'); ?></h5>
+            <label class="mw-ui-check">
+                <input type="checkbox" name="token" value="<?php print csrf_token() ?>" autocomplete="off"/> &nbsp;
+                <span><?php _e('Confirm'); ?></span>
+            </label>
+        </div>
+    </div>
+</div>
\ No newline at end of file

programming_language: PHP