CVE-2023-26469 Exploitation Tool

Overview

This is a Proof of Concept (PoC) exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques.

⚠️ Warning: This tool is intended for security research and authorized testing only. Unauthorized use of this tool to launch attacks is illegal.

Vulnerability Description

CVE-2023-26469 is a critical security vulnerability in Jorani 1.0.0, combining the following two attack vectors:

1. Log Injection: Injecting malicious PHP code into the application log file through the login form
2. Path Traversal: Accessing and executing the injected log file by exploiting a path traversal vulnerability

Attackers can leverage this vulnerability to execute arbitrary system commands on the target server.

Features

• Automatically fetch CSRF tokens
• Inject malicious PHP code into log files
• Access log files via path traversal
• Provide an interactive pseudo-terminal for executing system commands
• Support for Windows environments (using pyreadline3)
• Automatically encode commands to bypass detection

Requirements

• Python 3.x
• Dependencies:
  • requests
  • pyreadline3 (Windows environment)

Installation

pip install requests pyreadline3

Usage

python poc.py <target URL>

Example

python poc.py http://target-server.com

Interactive Command Execution

After the script successfully runs, you will enter a pseudo-terminal interface where you can execute system commands:

user@jorani(PSEUDO-TERM)
$ whoami
$ ls -la
$ cat /etc/passwd

Enter exit, quit, or x to exit the program.

How It Works

1. Session Initialization: Send requests to the target server to obtain session cookies and CSRF tokens
2. Inject Malicious Code: Use the language parameter in the login form for path traversal, injecting PHP code into the log file
3. Trigger Execution: Access the log file page to execute the injected PHP code
4. Command Execution: Pass Base64-encoded commands via custom HTTP headers to retrieve execution results

Technical Details

• Uses a randomly generated HTTP header field name to bypass certain security mechanisms
• Commands are transmitted via Base64 encoding
• Utilizes the X-REQUESTED-WITH header to bypass redirect protection
• Automatically generates the target log filename based on the current date

Disclaimer

This tool is intended for security research and educational purposes only. Users must:

• Only use this tool on systems for which they have explicit authorization
• Comply with all applicable laws and regulations
• Assume full responsibility for any consequences resulting from the use of this tool

The author is not responsible for any misuse or illegal use of this tool.

References

• CVE-2023-26469
• Jorani Official Website

License

This project is intended for educational and security research purposes only.