WebCT Privilege escalation vulnerability

Abstract

The vulnerability relays on the «autosignon script» default behavior and is triggered by the capability of a mal-intended user to capture an HTTP requests to the script, allowing him, without knowing the system shared secret, to properly manipulate the request fields and obtain an authenticated cookie gaining access to the target account, performing a vertical or horizontal privilege escalation.

Content Table

• Abstract

• Theorical Scenario

• Issue Description

• Vulnerability taxonomy

• Exposure Analysis

• ASR Capture

• ASR Manipulation

• Cookie Authentication

• Diagram References

• Technical References and other bibliographies

• Copyrights

Please Note:

The report will soon be free and fully available to public review in a PDF format, however if a proper request is made I will email it under a non-disclosure agreement, still I guess that it’s easier to just wait the public release.

Don’t forget to keep checking as it may be released at any time.