Microweber v1.2.10 Local File Inclusion (Authenticated) #16156
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bcoles
added
module
needs-docs
needs-linting
|
Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools. We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit: You can automate most of these changes with the Please update your branch after these have been made, and reach out if you have any problems. |
|
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
bcoles
reviewed
Feb 8, 2022
Comment on lines
171
to
183
| def run | ||
| is_version_valid = check_version | ||
| is_login_valid = login | ||
|
|
||
| if !is_version_valid || !is_login_valid | ||
| return | ||
| end | ||
|
|
||
| is_upload_successful = upload | ||
| if is_upload_successful | ||
| download | ||
| end | ||
| end |
There was a problem hiding this comment.
The returned values are only used once. Rather than store the returned values in temporary variables with meaningful names, it would make more sense to simply give the methods meaningful names.
There was a problem hiding this comment.
Thanks. I fixed it.
Added the documentation. |
adfoster-r7
reviewed
Feb 8, 2022
Comment on lines
41
to
42
| OptString.new('ADMIN_USER', [true, 'The admin\'s username for Microweber']), | ||
| OptString.new('ADMIN_PASS', [true, 'The admin\'s password for Microweber']), |
There was a problem hiding this comment.
I believe if we rename these fields to USERNAME and PASSWORD then the module should work with this syntax:
use auxiliary/gather/microweber_lfi
run http://user:pass@127.0.0.1
There was a problem hiding this comment.
Thanks I fixed it. You can now use run http://user:pass@127.0.0.1 to run the module.
|
Linting is done. |
|
@bcoles the module passed 16 checks including the lint. Could you remove |
bcoles
removed
the
needs-linting
sjanusz-r7
reviewed
Feb 10, 2022
Comment on lines
26
to
28
| 'SideEffects' => [ 'ARTIFACTS_ON_DISK', 'IOC_IN_LOGS' ], | ||
| 'Reliability' => [ 'REPEATABLE_SESSION' ], | ||
| 'Stability' => [ 'OS_RESOURCE_LOSS' ] |
There was a problem hiding this comment.
Utilise constants, not strings.
Suggested change
| 'SideEffects' => [ 'ARTIFACTS_ON_DISK', 'IOC_IN_LOGS' ], | |
| 'Reliability' => [ 'REPEATABLE_SESSION' ], | |
| 'Stability' => [ 'OS_RESOURCE_LOSS' ] | |
| 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], | |
| 'Reliability' => [ REPEATABLE_SESSION ], | |
| 'Stability' => [ OS_RESOURCE_LOSS ] |
| end | ||
|
|
||
| def check | ||
| check_version ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe |
There was a problem hiding this comment.
If we are checking the version, this should return Appears rather than Vulnerable.
| end | ||
|
|
||
| def check_version | ||
| print_warning 'Triggering this vulnerability may delete the local file that is wanted to be read.' |
There was a problem hiding this comment.
Could this warning be moved to the module info instead, so that a user receives this warning before running the module?
We might also benefit from using a DefangedMode approach, similar to
metasploit-framework/modules/exploits/windows/smb/smb_shadow.rb
Lines 76 to 85 in a458961
Comment on lines
67
to
68
| if version.include?('Version: 1.2.10') | ||
| print_good 'Microweber ' + version |
There was a problem hiding this comment.
Could we use a single regex to extract the version number?
Also we should make sure that the application we are targeting is actually Microweber, rather than assuming that.
Using Rex::Version would be preferred as seen here
| check_version ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe | ||
| end | ||
|
|
||
| def check_version |
There was a problem hiding this comment.
This method should become the check method, and should return CheckCodes rather than true/false.
| res = send_request_cgi({ | ||
| 'method' => 'GET', | ||
| 'uri' => normalize_uri(target_uri.path, 'api', 'BackupV2', 'upload'), | ||
| 'cookie' => @cookie, |
There was a problem hiding this comment.
Would this be a good candidate for using a cookie jar functionality? https://github.com/rapid7/metasploit-framework/wiki/How-to-Send-an-HTTP-Request-Using-HttpClient#keep_cookies-option
| 'filename' => filename | ||
| }, | ||
| 'headers' => { | ||
| 'Referer' => datastore['SSL'] ? 'https://' + datastore['RHOSTS'] + target_uri.path : 'http://' + datastore['RHOSTS'] + target_uri.path |
There was a problem hiding this comment.
Would using a referer helper method be beneficial? https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/remote/http_client.rb#L543
Comment on lines
48
to
52
| def check | ||
| check_version ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe | ||
| end | ||
|
|
||
| def check_version |
There was a problem hiding this comment.
Suggested change
| def check | |
| check_version ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe | |
| end | |
| def check_version | |
| def check |
| begin | ||
| version = res.body[/Version:\s+\d+\.\d+\.\d+/].gsub(' ', '').gsub(':', ': ') | ||
| rescue NoMethodError, TypeError | ||
| return false |
There was a problem hiding this comment.
Suggested change
| return false | |
| return Exploit::CheckCode::Safe |
|
|
||
| if version.include?('Version: 1.2.10') | ||
| print_good 'Microweber ' + version | ||
| return true |
There was a problem hiding this comment.
Suggested change
| return true | |
| return Exploit::CheckCode::Appears |
| end | ||
|
|
||
| print_error 'Microweber ' + version | ||
| return false |
There was a problem hiding this comment.
Suggested change
| return false | |
| return Exploit::CheckCode::Safe |
|
|
||
| if res.headers['Content-Type'] != 'application/json' | ||
| print_status res.body | ||
| return false |
There was a problem hiding this comment.
Suggested change
| return false | |
| fail_with(Msf::Exploit::Failure::Unknown, 'Invalid Content-Type returned') |
Comment on lines
162
to
163
| print_error json_res['error'] | ||
| return |
There was a problem hiding this comment.
Suggested change
| print_error json_res['error'] | |
| return | |
| fail_with(Msf::Exploit::Failure::Unknown, json_res['error']) |
Comment on lines
171
to
177
| if !check_version || !try_login | ||
| return | ||
| end | ||
|
|
||
| if try_upload | ||
| try_download | ||
| end |
There was a problem hiding this comment.
By prepending Msf::Exploit::Remote::AutoCheck the check method is run prior to the run method and will halt execution in a not vulnerable code is returned.
With other changes suggested to have methods call fail_with the module will raise early avoiding the need to run test each method call result.
Suggested change
| if !check_version || !try_login | |
| return | |
| end | |
| if try_upload | |
| try_download | |
| end | |
| try_login | |
| try_upload | |
| try_download |
|
Following @jmartin-r7 and @sjanusz-r7's advice, I updated the code and the documentation. |
|
Looks like this doesn't quite work for me - either for an admin account, or a normal user account. I didn't try a disabled account though. Here were my verification steps: Docker setupSetting up a docker environment: Visit http://localhost:8000 and create a new account with the credentials Verifying 1.2.11Verifying check method against a newer version: Works as expected 👍 Verifying 1.2.10Running against a vulnerable version: Running against a vulnerable version with defang mode false: The password is correct, verified by using incorrect credentials: Here's the request that led to the failure, enabled by I also added an extra user account that didn't have admin privileges: Running with defanged mode doesn't seem to handle this scenario gracefully, i.e. the file is treated as non-existent, but it's actually a permissions error: Verified by jumping into the container and verifying the contents is present: Here's the http logging for that scenario: |
|
Let me know if I missed any setup steps, or if you update the module again @talhak08 - and I should be able to run through testing this again 👍 |
@adfoster-r7 Thank you. I checked it. The issue was weird. The reason why you get Referer: http://127.0.0.1/ will not work! Could you reproduce the same thing in your testing environment? |
|
Thanks for checking, that seems to have been the issue 👍 I was able to confirm that Reading a non-existant file is handled as expected: It looks like user account credentials will receive a Potentially the check method/exploit method could be enhanced to work with user accounts, but I'm good to land this for now 👍 If you want to throw up a separate PR to improve that edge-case of providing user credentials, or the referrer being wrong, that would work too 🎉 |
|
Just thinking a bit more about the host/referrer edgecase, I wonder if that's more of an issue if the microweber app is behind a load balancer and the public facing/private ips will be different, or when the user specifying specifies a domain to target? 🤔 Adding to /etc/hosts: Targeting microweber.example.com and getting the error: |
|
@adfoster-r7 Thanks again. Non-administrator users cannot exploit this vulnerability due to the permission check: I changed the Nginx configuration. Added the GET /api/BackupV2/download?file=passwd HTTP/1.1
Host: example.microweber.com
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
X-Requested-With: XMLHttpRequest
Referer: http://example.microweber.com/admin/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: laravel_session=aqLhOQjqyvF53LmAGSipahbbDhWsBo2MrJ0uuyh2; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=1%7CFW5hrQuPMWEkWv1b8X09Ero2Bq3ZoFBXNKWkCpNpTAaltdX5NgrVBQCItwOj%7C%242y%2410%24.ag30XgeuoFHZnkP%2Fz7nKe0jyqu4ojm14yeiIkCfXvIZfGijpGcsO;
Connection: closeIt works! Let's look at the problem in Metasploit: As you can see the value in the I'm going to update the code. |
|
@adfoster-r7 I added |
|
@adfoster-r7 this is the proof of concept: |
|
If So this case is OK as well: |
Release NotesAdds a new module |
adfoster-r7
added
the
rn-modules
|
@talhak08 Thanks! 🎉 |
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Microweber CMS v1.2.10 LFI (Authenticated) has been verified and fixed according to the maintainer of the project. You check out the vulnerability report:
https://huntr.dev/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8b/
The older versions of Microweber CMS might be vulnerable too. I've not tested the module against the other versions.
If you want, you can follow the steps in the official vulnerability report to reproduce the vulnerability against the older versions. (not guaranteed)
PoC
2022-02-10.21-15-08.mp4
Verification Steps
msfconsoleuse auxiliary/gather/microweber_lfiRHOSTSUSERNAMEPASSWORDLOCAL_FILE_PATHexploitChecking if it's Microweber CMS.Microweber CMS has been detected.Checking Microweber's version.Microweber version 1.2.10The target appears to be vulnerable.Trying to log in.You are logged inUploading LOCAL_FILE_PATH to the backup folder.FILE was moved!Downloading FILE from the backup folder.Options
Scenerios
This module has been tested against Microweber CMS v1.2.10 installed on Ubuntu.