Language Dropdown Menu Manipulation in froxlor/froxlor
Reported on
Jan 27th 2023
Hello
It is possible to manipulate the Language Dropdown Menu and change it to anything the attacker wants.
Process of the Vulnerability:
- Login
- Go Miscellaneous -> Email & file templates
- Add Template -> Change & Save and intercept the Request
- Change the Language to anything you want
Lets see :)
As you can see there are specific Languages nobody can select anything else.
Lets put HACKED inside it :)
The language is now HACKED lets see
AS you can see the language is now HACKED and it got accepted even if we have a Dropdown Menu with specific Languages to choose from
Thank you for watching :)
Best regards Ahmed Hassan
Impact
Hello
It is possible to manipulate the Language Dropdown Menu and change it to anything the attacker wants.
Process of the Vulnerability:
- Login
- Go Miscellaneous -> Email & file templates
- Add Template -> Change & Save and intercept the Request
- Change the Language to anything you want
Lets see :)
As you can see there are specific Languages nobody can select anything else.
Lets put HACKED inside it :)
The language is now HACKED lets see
AS you can see the language is now HACKED and it got accepted even if we have a Dropdown Menu with specific Languages to choose from
Thank you for watching :)
Best regards Ahmed Hassan
References
Why would you select "integrity: high" here? What files can be read/modified? The only impact i can see is that the template just not being used because no customer has the language "HACKED". Also, adding templates is an admin-privileged compoonent, which would set "required permissions" to high, leading to: https://cvss.js.org/#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Because the Dropdown Menu should not be able to manipulate and this should be fixed. Therefore the Intigrity is hit cause some "fixed" Data which should be not allowed to change was manipulated.
okay, fair enough. Do you agree on this requiring high privileges though?
definitely yeah cause the template was generated by the admin account (the highest User or Administrator) and this is a high privilege account and the highest in the whole Application.