purgemebaby/cve-2018-11736PoC exploit for CVE-2018-11736 affecting Pluck CMS versions prior to 4.7.7-dev2 with a File Upload Vulnerability
Disclaimer ⚠️: This exploit was developed in Rust primarily as an introductory programming learning exercise. Please excuse any lack of technical rigor or non-idiomatic code patterns. Also, this is not my discovery; I relied on official reports to write this exploit.
PoC exploit for CVE-2018-11736 affecting Pluck CMS versions prior to 4.7.7-dev2. The vulnerability resides in /data/inc/images.php, which allows an attacker to upload arbitrary files. By uploading a malicious .htaccess file disguised with the image/jpeg MIME type, it is possible to coerce the web server into interpreting .jpg files as PHP scripts, leading to arbitrary PHP code execution.
You must have Cargo installed to compile main.rs.
cargo build
And a valid authenticated session cookie from the target Pluck CMS instance is required:
./CVE-2018-11736 -h
CVE-2018-11736 exploit. Uploads a malicious .htaccess to force the web server to interpret .jpg files as PHP scripts, leading to Remote Code Execution (RCE)
Usage: CVE-2018-11736 --cookie <COOKIE> --base-url <BASE_URL> --hta-path <HTACCESS> --image-path <IMAGE>
Options:
-c, --cookie <COOKIE> Session Cookie (Once you have logged in succesfully). Format: xxxxxxxxxxxx
-u, --base-url <BASE_URL> Base URL (e.g. http://localhost)
-H, --hta-path <HTACCESS> Path to the .htaccess file
-i, --image-path <IMAGE> Path to the fake image file
-h, --help Print help
-V, --version Print version
To ensure reproducibility and safe testing, a vulnerable instance of Pluck CMS v4.7.4-dev5 can be deployed using Docker. To deploy it, you need to download the .zip of the vulnerable version:
wget https://github.com/pluck-cms/pluck/archive/refs/tags/4.74-dev5.zip
Then, run the next command in the same directory of the docker files:
docker-compose up -d
The web application will be avalaible at http://localhost:8080. If you want to spawn a TTY inside the container:
docker exec -it pluck-cms bash
Here is the PoC in action, demonstrating the upload of the malicious configuration and the RCE.
