Cross-Site Request Forgery in MultiJuicer

Executive Summary

This vulnerability exists in MultiJuicer versions 8.0.0 through 10.0.0, specifically in the team join endpoint (POST /multi-juicer/api/teams/{team}/join). The endpoint accepts requests with any Content-Type, including text/plain, which does not trigger a CORS preflight check.

An attacker can exploit this by hosting a cross-site HTML form that auto-submits to the endpoint, causing a victim's browser to log in as the attacker's team without the victim's knowledge or consent.

This attack does not require prior authentication and only requires the victim to visit a page controlled by the attacker while having network access to the MultiJuicer deployment.

The attack works by planting a new session cookie rather than relying on an existing one, so protections like SameSite=Strict on cookies do not prevent it.

In a Capture The Flag (CTF) context, this allows the attacker to inflate their team's score using other players' activity and access any sensitive data the victim enters into the Juice Shop under the attacker's team identity.

This vulnerability was fixed in MultiJuicer version 10.0.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to hijack your session and force your browser to log in as the attacker's team without your knowledge.

As a result, any actions you take, such as solving challenges in the Juice Shop, will be attributed to the attacker's team, potentially inflating their score unfairly.

Additionally, any sensitive data you enter while logged in under the attacker's team identity could be exposed to the attacker.

This attack requires only that you visit a page controlled by the attacker while having network access to the MultiJuicer deployment, making it relatively easy to exploit.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade MultiJuicer to version 10.0.1 or later, where the issue has been fixed.

Additionally, consider restricting or validating the Content-Type header on the team join endpoint to prevent acceptance of unsafe content types like text/plain.

Ensure users are aware of the risk of visiting untrusted web pages while connected to the MultiJuicer deployment.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to force victims to log in as the attacker's team, potentially causing sensitive data entered by the victim to be exposed to the attacker. This unauthorized exposure of sensitive data could lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require protection of personal and sensitive information against unauthorized access.

Since the attack can occur without prior authentication and involves cross-site request forgery that results in data leakage, organizations using affected versions of MultiJuicer might face risks related to confidentiality and data integrity, which are critical aspects of compliance frameworks.

However, the vulnerability was fixed in version 10.0.1 by enforcing JSON content-type validation, which mitigates the risk of such attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for POST requests to the MultiJuicer team join endpoint (/multi-juicer/api/teams/{team}/join) that use content types other than application/json, such as text/plain. Since the vulnerability involves accepting any Content-Type without triggering CORS preflight, detecting requests with suspicious Content-Type headers can indicate exploitation attempts.

You can use network traffic inspection tools like curl or tcpdump to identify such requests. For example, using curl to test the endpoint with a non-JSON content type:

• curl -v -X POST https://<multi-juicer-host>/multi-juicer/api/teams/<team>/join -H "Content-Type: text/plain" -d "some data"

If the server accepts this request without rejecting it with a 415 Unsupported Media Type response, it indicates the vulnerable behavior.

Alternatively, you can use tcpdump or Wireshark to capture HTTP POST requests to the endpoint and filter for Content-Type headers that are not application/json.

• tcpdump -i <interface> -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'POST /multi-juicer/api/teams/' -A 10 | grep -i 'Content-Type'

These methods help detect attempts to exploit the vulnerability by identifying requests that do not comply with the fixed requirement of Content-Type: application/json.

Useful 0 Not Useful 0