Session Fixation- Smart Vista SVFE-2 Module [CVE-2018-15208]

March 31, 2019

[+] Credits: Neeraj Kumar, Raj Kumar Yadav, Hai Dang Long

[+] Email: neeraj.iiita2009@gmail.com

Vendor:

====================

https://www.bpcbt.com/

Product:

===================

Smart Vista

Version:

===================

Smartvista Front-End (SVFE)- Version 2

Vulnerability Type:

==========================

Session Fixation

CVE Reference:

==============

CVE-2018-15208

Vulnerability Details:

======================

Smartvista is a suite of payment infrastructure and management systems created by BPC Group. It is vulnerable session fixation attack as a valid session of an existing user can be compromised by performing Man in the Middle attacks. An attacker can gain full access to the victim’s account and thus can perform malicious activities on his behalf.

POC Code-

======================

Attacker Browser: Google Chrome

Victim Browser: Mozilla Firefox

1. To fix the session attacker will first get the valid session cookie from the login page and craft it in link and later he will send it to victim using below payload,

Attacker Cookie:

< klzxhyVQNnz2vSMKTG5TLpn97JCBp03HyThWKqbQrLv3hRCv9nLY!936852909>

Payload to be sent:

document.cookie='JSESSIONID= klzxhyVQNnz2vSMKTG5TLpn97JCBp03HyThWKqbQrLv3hRCv9nLY!936852909;path=/;domain=<Target Domain>’;alert('Session fixed');

2. If victim clicks on this payload the session cookie gets appended in the browser. Once victim load the target application the appended cookie where application accepts the attacker's session cookie and used throughout the session without change. Attacker now fix the above cookie in his browser and set the landing page in URL.

Disclosure Timeline:

=====================

Vendor Notification: 17 June 2018

Mitre Notification: 08 August 2018

Public Disclosure: 31 March 2019

Attack Type:

=====================

Remote

Impact Code execution:

=====================

True

Impact Information Disclosure

=====================

True

Reference

=====================

https://www.owasp.org/index.php/Top_10-2017_A2-Broken_Authentication

[+] Disclaimer

=====================================================

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. All content (c).