Mongoose Web Server up to 6.8 _mg_admin Save cross-site request forgery

Summaryinfo

A vulnerability classified as problematic has been found in Mongoose Web Server up to 6.8. This vulnerability affects unknown code of the file _mg_admin. The manipulation of the argument Save as part of Request leads to cross-site request forgery. This vulnerability is referenced as CVE-2017-11567. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Mongoose Web Server up to 6.8 (Web Server). This issue affects some unknown processing of the file _mg_admin. The manipulation of the argument save as part of a Request leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.

The bug was discovered 09/04/2017. The weakness was published 09/07/2017 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The identification of this vulnerability is CVE-2017-11567 since 07/23/2017. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 87300 (Mongoose Web Server Cross-Site Request Forgery Vulnerability).

Upgrading to version 6.9 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (42614). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Mongoose

Name

• Web Server

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion