CVE-2019-13497 PoC — One Identity Cloud Access Manager 跨站请求伪造漏洞

Source

Associated Vulnerability

Readme

# CVE-2019-13497

Exploit Title: Cross Site Request Forgery (CSRF)<br>
Date: 07/10/2019<br>
Exploit Author: Furqan Khan<br>
Vendor Homepage: https://www.oneidentity.com/<br>
Software Link: https://www.oneidentity.com/products/cloud-access-manager/<br>
Version: 8.1.3<br>
Tested on: Kali Linux , Windows 7 ,Ubantu 16.04<br>

#### To exploit this vulnerability an attacker can simply create a HTML form that would submit a logout request and share the link with the victim.On clicking the link , the logout request will be triggered in background and it shall logout the victim from his valid session and from the website..

## The content of CSRF payload is given as under ##
![injected.jpg](https://github.com/FurqanKhan1/CVE-2019-13497/blob/master/CSRF.PNG)

##### Now when the victim would load / click the attcak link shared , he would get logged out from his session #####
![injected.jpg](https://github.com/FurqanKhan1/CVE-2019-13497/blob/master/logged_out.PNG)

#####  Bingo ! That was easy ! #####

File Snapshot

 [4.0K]  /data/pocs/f3adf59650832c5f99df8ff222801b2e74f912c3
├── [163K]  CSRF.PNG
├── [ 33K]  logged_out.PNG
└── [1005]  README.md

0 directories, 3 files

Remarks