> For the complete documentation index, see [llms.txt](https://eslam3kl.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eslam3kl.gitbook.io/blog/web-application-findings/cve-2021-34785-cisco-broadworks-privileged-escalation.md).

# \[CVE-2021–34785] Cisco BroadWorks - Privileged Escalation

https\://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-dJ9JT67N

Hello Everyone! Today I will talk about my last findings at Cisco products **BroadSoft BroadWorks**, one of the Cisco's products. 

**CVE-2021–34785**: IDOR lead to privileges escalation “Admin account takeover”

<figure><img src="https://cdn-images-1.medium.com/max/800/1*-QfHKCEhP8jDCCOrwptTCw.png" alt=""><figcaption></figcaption></figure>

## **Content**

1. [BroadWorks structure](#broadworks-structure)
2. [Exploitation](#exploitation)
3. [Weakness points](#weakness-points)

### **BroadWorks structure**

At BroadWorks, we have an Admins group which have admins with write and read privileges and other admins with read-only privileges.

1. Read and Write: he can modify his data and other admins' data. Also, he can add users, change system preferences, delete users, and fully control the system
2. Read-only: he can modify his data and delete his account. He doesn’t have any other privileges “In my case”

I’ve got the second role (Read-only) and my task is trying to escalate my privileges to have Read and Write actions.

### **Exploitation**

If you tried to view system users, we have 2 users: `Admin` and `PentestAdmin`. My user is `PentestAdmin` which has low privileges, reads his data only. User Admin has full control of the system

<figure><img src="https://cdn-images-1.medium.com/max/800/1*eJmzHbm0_nJGv4J3alln9A.png" alt=""><figcaption></figcaption></figure>

I tried to enumerate the admin account to know what allowed functions, but unfortunately! There’s no allowed function to use at the Admin profile, I can view the data only, but at ll, I know the `firstname`, `lastname` and `adminID`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*0ONgbYW3tFMHr7LSKenSSQ.png" alt=""><figcaption></figcaption></figure>

After that, I tried to enumerate my account and found that I have 2 allowed functions delete the account and change the password without asking you for your old password, weird right?!

<figure><img src="https://cdn-images-1.medium.com/max/800/1*sNLFJ1Tcj7a3-ncv6ba7kw.png" alt=""><figcaption></figcaption></figure>

I entered a new password and intercepted the request to know what’s the request parameters. I’ve found that we have `firstname, lastname` and `loginid` required parameters because I tried to delete `loginid` but unfortunately! The request failed

<figure><img src="https://cdn-images-1.medium.com/max/800/1*o0T0wHOv4uLqUse55IhvNg.png" alt=""><figcaption></figcaption></figure>

At all, it’s not a problem because I have privileges to read all users' data, so I know this data from the admin profile.

The final step is replacing your data with Admin data and sending the request. It returns 200 OK and to check, I tried to log in with the new password, and Bingo! You take over the admin account by changing his password ❤

<figure><img src="https://cdn-images-1.medium.com/max/800/1*sL7HCG8xgjmVH4U8s2y4Ew.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://cdn-images-1.medium.com/max/800/1*q7mWUcIWp9Yr0NKDJJ2d1A.jpeg" alt=""><figcaption><p>Me with my friend after success ❤</p></figcaption></figure>

To make POC, I’ve created a new user `SecmeterPOC` with writing and reading privileges.

<figure><img src="https://cdn-images-1.medium.com/max/800/1*6Z2-3fGAu0tb6wVnIyyJBA.png" alt=""><figcaption></figcaption></figure>

After reviewing the Admin board

<figure><img src="https://cdn-images-1.medium.com/max/800/1*UCwo35j5wU6g6lRqgei6WA.png" alt=""><figcaption></figcaption></figure>

### **Weakness points**

1. At the change password function, it MUST ask me for the old password and if I forget it, it should ask me to contact the system administrator.
2. There’s no CSRF token attached with the user session to protect the system from performing the same attack using CSRF \[I have tried it and successed]
3. To delete an account, it MUST ask the user to enter his password or any security question

**Thanks for reading <3 Stay in touch**

[LinkedIn ](https://www.linkedin.com/in/eslam3kl/)| [GitHub](https://github.com/eslam3kl) | [Twitter](https://twitter.com/eslam3kll)