FirstBlood-#474[COLLAB with isitbug] Able to change doctor passwords via admin API that is accessible by any doctor
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-25, shreky Level 5 reported:

Correction to title --> THE API IS ACCESSIBLE BY ANYONE

Summary

In the source code of /drpanel/index.php there is the following code snippet:

/* to do
 function editpassword(username) {
 var xhr = new XMLHttpRequest();
 xhr.open("POST", '', true);
 xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

 xhr.onreadystatechange = function() {
     if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
         alert(this.responseText);
         } else {

         }
     }

 xhr.send();
 } */

Which suggests that there is a function to edit the password of accounts,however the endpoint is not shown to us not even if we're admin(tested after I logged in as admin user).Through absolute guessing on the first try I found the endpoint /drpanel/drapi/editpassword.php which was returning blank,changing it to POST and adding the parameter username as the code suggests,it successfully changed the password of the user drAdmin.

Steps to reproduce

  1. Make a POST request to /drpanel/drapi/editpassword.php with the POST parameter username=drAdmin
  2. The server will respond with the new password of the user

Impact

ANY USER is able to update the password of any doctor/admin if their username is known which leads to the takeover of their account and if they're admin for example drAdmin,they get full access as admin.

Request PoC(notice there's NO cookies set) -->

P1 CRITICAL

Endpoint: /drpanel/drapi/editpassword.php This bug makes use of the following vulnerabilities in a chain:

  • Auth issues
  • Auth issues


FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.