KCFinder - Exposure Detection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Detected publicly accessible KCFinder instances that may have allowed arbitrary file uploads and remote code e."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Scanner, Http_client):
    __info__ = {
        'name': 'KCFinder - Exposure Detection',
        'description': 'Detected publicly accessible KCFinder instances that may have allowed arbitrary file uploads and remote code execution (RCE).Exposure of KCFinder could have allowed an attacker to gain unauthorized access to the file manager and upload malicious files.',
        'author': ['KittySploit Team'],
        'severity': 'high',
        'tags': ['web', 'scanner', 'exposure', 'kcfinder', 'file-upload'],
        'agent': {
            'risk': 'active',
            'effects': ['network_probe'],
            'expected_requests': 6,
            'reversible': True,
            'approval_required': False,
            'produces': ['tech_hints', 'risk_signals', 'endpoints'],
            'cost': 1.0,
            'noise': 0.3,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {
                        'capability': 'admin_surface',
                        'from_detail': '',
                    },
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': ['auxiliary/scanner/http/login_page_detector'],
            },
        },
        'references': ['https://github.com/sunhater/kcfinder'],
    }

    def run(self):
        for path in ('/', '/kcfinder/browse.php', '/assets/kcfinder/browse.php', '/lib/kcfinder/browse.php', '/admin/kcfinder/browse.php', '/includes/kcfinder/browse.php'):
            r = self.http_request(method="GET", path=path, allow_redirects=False)
            if not r or r.status_code != 200:
                continue
            body = r.text or ""
            body_all = ('<title>KCFinder:', 'id="files"',)
            if (all(m in body for m in body_all)):
                self.set_info(
                    severity='high',
                    reason="KCFinder - Exposure detected",
                    path=path,
                )
                return True
        return False