############################################################# # # COMPASS SECURITY ADVISORY # https://www.compass-security.com/research/advisories/ # ############################################################# # # Product: PRTG Network Monitor [1] # Vendor: Paessler AG # CSNC ID: CSNC-2022-008 # CVE ID: CVE-2021-34547 # Subject: Cross-Site Request Forgery (CSRF) # Risk: High # Effect: Remotely exploitable # Author: Emanuele Barbeno (advisories@compass-security.com) # Date: 09.06.2022 # ############################################################# Introduction: ------------- PRTG Network Monitor is an agentless network monitoring software from Paessler AG. It can monitor and classify system conditions like bandwidth usage or uptime and collect statistics from miscellaneous hosts as switches, routers, servers and other devices and applications.[2] Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application through crafted requests. [3] Affected: --------- Vulnerable: * 21.1.66.1623 Not Vulnerable: * 22.1.74.1869 Technical Description --------------------- Requests do not include Anti-CSRF tokens. Therefore, an attacker can guess entire requests. Abusing this via prepared links/forms allows them to make logged-in users execute actions unintendedly in the application. For instance, the following Proof of Concept code can be used to create a new PRTG_Admin user with administrative privileges sending a POST request using the victim's session cookie: ``` ``` Since the session cookie doesn't have the Same-Site flag set, CSRF attacks with POST HTTP method work on all browsers except Chrome because it automatically sets the SameSite flag by default to lax. Workaround / Fix: ----------------- Use CSRF tokens to prevent CSRF attacks. Timeline: --------- 2021-03-12: Discovery by Emanuele Barbeno 2021-03-12: Initial vendor notification 2021-09-06: Initial vendor response 2021-09-06: Assigned CVE-2021-34547 2022-06-09: Public disclosure References: ----------- [1] https://www.paessler.com/prtg [2] https://en.wikipedia.org/wiki/PRTG_Network_Monitor [3] https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html