Thursday, February 1, 2018

Gem in a box CSRF file upload - CVE-2017-14506

In this blog post I will give a short example of exploiting CSRF vulnerability on Geminabox.
So Geminabox is an application allows you manage your internal gems was vulnerable to CSRF on upload file.
In order to exploit the CSRF vulnerability I wrote really small tool called csrFile, which allows you to generate HTML that uploads any type of file to the supplied endpoint, you can check it out in the following link:
https://github.com/Quitten/csrFile
Usage: python csrFile.py <url> <filePath>

So using the following command, you can easily create an HTML document that exploits the CSRF attack and uploads malicious gem file to the targeted server:
python csrFile.py https://geminaboxserve/upload xss.gem

Then in case the victim will browse to the attacker's link that contains the HTML generated from csrFile, his browser will automatically will upload the attacker's malicious gem to geminabox system.
Note: it is possible to exploit persistent XSS attack (CVE-2017-14506) in that way as well.


12 comments:

  1. Save Your Relationship and Get Your Ex Boyfriend/Girlfriend Back!contact: Unityspelltemple@gmail.com is certainly the best spell caster online and his result is 100% guarantee.
    My Name Olivia Stephen form Tx,USA. After 12years of marriage, me and my husband has been into one quarrel or the other until he finally left me and moved to California to be with another woman. I felt my life was over and my kids thought they would never see their father again. i tried to be strong just for the kids but i could not control the pains that torments my heart, my heart was filled with sorrows and pains because i was really in love with my husband. Every day and night i think of him and always wish he would come back to me, I was really upset and i needed help, so i searched for help online and I came across a website that suggested that Dr Unity can help get ex back fast. So, I felt I should give him a try. I contacted him and he told me what to do and i did it then he did a Love spell for me. 28 hours later, my husband really called me and told me that he miss me and the kids so much, So Amazing!! So that was how he came back that same day,with lots of love and joy,and he apologized for his mistake,and for the pain he caused me and the kids. Then from that day,our Marriage was now stronger than how it were before, All thanks to Dr Unity. he is so powerful and i decided to share my story on the internet that Dr.Unity real and powerful spell caster who i will always pray to live long to help his children in the time of trouble, if you are here and you need your Ex back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact
    Call/WhatsApp: +2348071622464 ,
    Email: Unityspelltemple@gmail.com ,
    Website:https://unityspelltmple.blogspot.com .

    ReplyDelete
    Replies
    1. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465


      My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465


      My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465

      Delete
    2. My name is Handford Ann,i base in canada.i want to share my wonderful testimony on how i got back my ex-lover of my life back, he left me for another woman for no reason and i try to make things work for both of us yet things where getting worse and i love him so much and there is nothing i could do to get my ex back until i met a testimony share by Maria from USA on the internet talking about a powerful spell caster who brought his ex lover back within 48hours and i decide to give it a try and to my greatest surprise he also did it for me just as he did for Maria and i have a lot of people complaining of fake spell caster but this one i met was a real spell caster who help me to solve my problem i have no solution to,i introduce many of my best friends that have a similar problems,and their problem were solve with the great help of Dr.Trust. They get back their ex within 48 hours. I am so happy that my ex is back to me again,and the most surprise,is that our love is very strong,every day is happiness and joy. and there is nothing like been with the man you love.i am so happy my love is back to me with the help of Dr.Trust. If you have any problem in your relationship i will advice you to contact him now (Ultimatespellcast@yahoo.com or Ultimatespellcast@gmail.com) Call or Text him now +1(317) 762-7416

      Delete
    3. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

      Delete
    4. Hello, I am Theresa Williams After being in relationship with Anderson for years, he broke up with me, I did everything possible to bring him back but all was in vain, I wanted him back so much because of the love I have for him, I begged him with everything, I made promises but he refused. I explained my problem to my friend and she suggested that I should rather contact a spell caster that could help me cast a spell to bring him back but I am the type that never believed in spell, I had no choice than to try it, I mailed the spell caster, and he told me there was no problem that everything will be okay before three days, that my ex will return to me before three days, he cast the spell and surprisingly in the second day, it was around 4pm. My ex called me, I was so surprised, I answered the call and all he said was that he was so sorry for everything that happened that he wanted me to return to him, that he loves me so much. I was so happy and went to him that was how we started living together happily again. Since then, I have made promise that anybody I know that have a relationship problem, I would be of help to such person by referring him or her to the only real and powerful spell caster who helped me with my own problem. His email: {drogunduspellcaster@gmail.com} you can email him if you need his assistance in your relationship or any other Case.
      1) Love Spells
      2) Lost Love Spells
      3) Divorce Spells
      4) Marriage Spells
      5) Binding Spells
      6) Breakup Spells
      7) Banish a past Lover.
      8.) You want to be promoted in your office
      9) want to satisfy your lover
      Contact this great man if you are having any problem for a lasting solution
      through {drogunduspellcaster@gmail.com}

      Delete
    5. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

      i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

      Delete
  2. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

    ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

    Blog: https://effectivespell1.blogspot.com

    Website http://ancientspiritspellcast.website2.me

    WhatsApp +2347059715465

    ReplyDelete
    Replies
    1. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

      Delete
  3. My name is Handford Ann,i base in canada.i want to share my wonderful testimony on how i got back my ex-lover of my life back, he left me for another woman for no reason and i try to make things work for both of us yet things where getting worse and i love him so much and there is nothing i could do to get my ex back until i met a testimony share by Maria from USA on the internet talking about a powerful spell caster who brought his ex lover back within 48hours and i decide to give it a try and to my greatest surprise he also did it for me just as he did for Maria and i have a lot of people complaining of fake spell caster but this one i met was a real spell caster who help me to solve my problem i have no solution to,i introduce many of my best friends that have a similar problems,and their problem were solve with the great help of Dr.Trust. They get back their ex within 48 hours. I am so happy that my ex is back to me again,and the most surprise,is that our love is very strong,every day is happiness and joy. and there is nothing like been with the man you love.i am so happy my love is back to me with the help of Dr.Trust. If you have any problem in your relationship i will advice you to contact him now (Ultimatespellcast@yahoo.com or Ultimatespellcast@gmail.com) Call or Text him now +1(317) 762-7416

    ReplyDelete
    Replies
    1. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

      i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

      Delete

  4. I was crushed when my lover of three years left to be with another woman. I cried and sobbed every day, until it got so bad that I reached out to the Internet for help.And i saw a testimony of a spell caster who help a girl called Kate Jackson and i said let me give it a try so i contact him for help and he cast a love spell for me which i use in getting my love back and now i am a happy woman.For what you have done for me,i will not stop to share your goodness to people out there for the good work you are doing.I hope God blesses you as much as you have help me to get my Love back,visit him on OKAYASPELLHELP@GMAIL.COM,he is the only answer to your problems OKAYASPELLHELP@GMAIL.COM OR call/Whatsapp +27814506790

    ReplyDelete
  5. My Name is Ryan Ken i want to testify about Dr Okaya How he help me won the Lottery

    i won $1,000,000 in lottery, I took an advice from some person who talked about this great spell caster called Dr Okaya the person placed a testimonies on a blog saying how Dr Okaya helped him win the lottery by sending him the winning number i was curious and i thought it was all joke not until i contacted this spell caster to know for myself how this work cause i have spend a lot buying tickets and i never win. I contacted him and he told me the necessary thing that need to be done and i did it and he told me to wait for 24Hours and truly he gave me the winning numbers to play the lottery which i did, Can you believe my name was the first among winners. He told me (my son all i need you to do for me is make sure that you share this testimonies to others so that they can also win the lottery cause i do not have much time to spell on the internet) so that is why i am sharing this testimony with you that if you want to win the lottery this is the way online tips can help you, his email is OKAYASPELLHELP@GMAIL.COM OR call/Whats app +27814506790 is the only answer to that your problem of winning the lottery

    ReplyDelete