mallo-m/cve-2024-55187
Sensitive administrative parameters are not sufficiently sanitized, allowing an attacker to poison paths to system binaries.
The attacker can then upload dangerous CSV files that can then be treated as PHAR archives holding shell metacharacters that will be evaluated by PHP's exec() call, resulting in remote code execution.
Critical - 9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
In the file functions/classes/class.Scan.php, we can the following code structure:
The first parameter of the exec() call is directly dependent on the $ping_path parameter, which can be freely modified from the Admin Settings panel:
The only condition the attacker must fulfill is to make the ping_verify_path function not return false. The definition of this method is the following:
This method relies solely on the file_exists() PHP native function. This particular function can support passing ZIP files (.zip extension is not necessary) and dive into the structure of the ZIP archive. For instance:
Therefore, if an attacker can upload a valid ZIP/PHAR archive on the server, which contains a file with a name containing shell metacharacters, it will bypass the file_exists() check and get those metacharacters evaluated by the exec() call.
An authenticated attacker can upload files through the "XLS / CSV subnet import" functionality:
Said file doesn't have to be a valid CSV file. If the import fails, the file will not be deleted from the server. We also know where it will be stored from the import-verify.php script:
The attacker has know all the prerequisites to execute a Remote Code Execution attack :
The malicious archive can be crafted like so:
https://www.youtube.com/watch?v=oMvyfFrlRAs
