a32e028b88
17 changes to exploits/shellcodes VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow Linux - Use-After-Free Reads in show_numa_stats() WebKit - UXSS via XSLT and Nested Document Replacements Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution (Metasploit) ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit) ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution (Metasploit) Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit) BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting Cisco Adaptive Security Appliance - Path Traversal (Metasploit) UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion osTicket 1.12 - Persistent Cross-Site Scripting via File Upload osTicket 1.12 - Formula Injection osTicket 1.12 - Persistent Cross-Site Scripting Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection Linux/x64 - Bind (4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (162 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (151 bytes) Linux/x64 - Egghunter (0x50905090) Shellcode (18 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (151 bytes) Linux/x64 - Egghunter (0x50905090) Shellcode (18 bytes) Linux/x64 - execve() + XOR/NOT/DIV Encoded Shellcode (54 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Polymorphic Shellcode (122 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell + Password (hack) + Polymorphic Shellcode (135 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Polymorphic Shellcode (122 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell + Password (hack) + Polymorphic Shellcode (135 bytes) Linux/x64 - execve() Stack + Polymorphic Shellcode (47 bytes)
51 lines
No EOL
2.1 KiB
Text
51 lines
No EOL
2.1 KiB
Text
# Exploit Title: osTicket-v1.12 Formula Injection
|
|
# Vendor Homepage: https://osticket.com/
|
|
# Software Link: https://osticket.com/download/
|
|
# Exploit Author: Aishwarya Iyer
|
|
# Contact: https://twitter.com/aish_9524
|
|
# Website: https://about.me/aish_iyer
|
|
# Category: webapps
|
|
# CVE: CVE-2019-14749
|
|
|
|
1. Description
|
|
|
|
|
|
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
|
|
CSV (aka Formula) injection exists in the export spreadsheets
|
|
functionality. These spreadsheets are generated dynamically from
|
|
unvalidated or unfiltered user input in the Name and Internal Notes fields
|
|
in the Users tab, and the Issue Summary field in the tickets tab. This
|
|
allows other agents to download data in a .csv file format or .xls file
|
|
format. This is used as input for spreadsheet applications such as Excel
|
|
and OpenOffice Calc, resulting in a situation where cells in the
|
|
spreadsheets can contain input from an untrusted source. As a result, the
|
|
end user who is accessing the exported spreadsheet can be affected.
|
|
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14749
|
|
|
|
2. Proof of Concept
|
|
|
|
Steps to Reproduce:
|
|
- Login as an agent and under the "Users" section create a new user.
|
|
- Insert the crafted payload of Formula Injection into "Name" and "Internal
|
|
Notes" field.
|
|
- Login as another agent and under the Users tab, click on export and then
|
|
save the ".csv" file.
|
|
- It is observed that the payload gets executed in excel and this leads to
|
|
remote code execution.
|
|
- Not just an agent, even a non-agent user has the option to edit his name
|
|
where he can insert the malicious payload of Formula Injection.
|
|
- The application does not sanitize the inputs here due to which when the
|
|
agent clicks on export the payload gets executed.
|
|
-The same issue persisted in the "Issue Summary" field in the tickets tab.
|
|
|
|
3. Reference
|
|
|
|
https://github.com/osTicket/osTicket/commit/99818486c5b1d8aa445cee232825418d6834f249
|
|
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
|
|
https://github.com/osTicket/osTicket/releases/tag/v1.10.7
|
|
|
|
4. Solution
|
|
|
|
The vulnerability has been patched by the vendor in the next release which
|
|
is osTicket v1.10.7. |