Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Exponent CMS 2.3.7 - Command Execution Vulnerability

#1347

Description:

Exponent CMS → 2.3.7 suffers from an unauthenticated arbitrary command execution vulnerability. The issue is caused due to the improper verification of elfinder's manager. This can be exploited to execute arbitrary PHP code by creating or uploading a malicious PHP script file that will be stored in '/files' directory.

Please find attached POC.

Below URL's allows unauthenticated attacker to create file(sachin) in '/files' directory.

http://localhost/exponent-2.3.7/framework/modules/file/connector/el...

Credit:

Sachin Wagh(@tiger_tigerboy)

Reported by Sachin Wagh · January 30th, 2016 @ 03:39 PM

State: new
Milestone: User issues
Assigned to: dleffler dleffler

Activity

  1. Sachin Wagh
    Sachin Wagh

    Hi dleffler,

    I achieved this through File Manager. It allows to upload .php file and you can access it through http://localhost/exponent-2.3.7/files/$filename$.php

    It allows to execute system level command as shown in the POC.

    The interesting part is that once its uploaded unauthenticated user can also access same file and execute malicious command.

    Thanks a lot.

    January 31st, 2016 @ 04:04 PM

  2. Sachin Wagh
    Sachin Wagh
    • Assigned user set to expNinja

    Hi,

    Please find attached POC video.

    Thanks.

    February 1st, 2016 @ 06:44 AM

  3. Sachin Wagh
    Sachin Wagh

    Hi dleffler,

    Agree for below point

    "the 'page not found' exponent message is due to attempting to open a folder which the main .htaccess file has the server kick over as a 404 error. This is expected behavior with an attempt to open any 'folder' path within the exponent folder system under apache"

    If you access '/files/' it's giving error as expected.

    But if you access '/files/$uploaded_file$.php' it will not giving any error (e.g authorized failed/page not found/bad request) even user is not login to the application.Uploaded scripts gets executed.

    Thanks a lot.

    February 1st, 2016 @ 04:34 PM

  4. Sachin Wagh
    Sachin Wagh

    Hi dleffler,

    Any update on this.

    Thanks.

    Best Regards,

    Sachin Wagh.

    February 3rd, 2016 @ 07:09 PM

  5. Sachin Wagh
    Sachin Wagh

    Hi dleffler,

    I verified again. It is possible to execute PHP script.After uploading PHP script if you access directly as http://www.example.com/files/shell.php.

    Thanks.

    Best Regards,

    Sachin Wagh

    February 10th, 2016 @ 02:04 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.