CVE-2018-8979

Vulnerability

Open-AudIT Professional version 2.1 is affected by a cross-site request forgery (CSRF) vulnerability. The application does not implement any anti-CSRF tokens or validation mechanisms on its credential creation endpoint (/credentials). This lack of protection allows an attacker to craft a malicious HTML form that, when submitted by an authenticated user, will create a new credential entry. Furthermore, the name and description parameters of the credential form are not sanitized, enabling stored cross-site scripting (XSS). The attacker can chain these weaknesses to inject arbitrary JavaScript into the application [1][2].

Exploitation

An attacker needs to lure an authenticated victim into visiting a crafted HTML page while the victim has an active session in the Open-AudIT Professional 2.1 application. The attacker creates a form that automatically submits a POST request to /credentials with a payload that includes an XSS payload in the name field (e.g., `) and sets the type parameter to ssh` and other credential fields. The form is automatically submitted via JavaScript or by placing the victim on the page with an auto-submitting form. No CSRF token is required, so the request is processed by the application [1][2].

Impact

A successful attack results in the creation of a new credential entry containing an attacker-controlled XSS payload. The stored XSS will execute in the browser of any user who views the credentials page, potentially allowing the attacker to steal session cookies, perform actions on behalf of the victim, escalate privileges (e.g., creating an admin account), or compromise the entire user account. The attacker does not need any prior authentication or elevated privileges beyond the victim being logged in [1][2].

Mitigation

As of the available references (2018-03-27), no official patch or fixed version had been released. The vendor (Open-AudIT) has not provided a workaround. Users of Open-AudIT Professional 2.1 are advised to apply strict input validation and output encoding on the affected parameters (name, description) and implement CSRF tokens for all state-changing operations. The vulnerability is listed on the Exploit Database and should be prioritized for remediation [1][2].