Adds modules for Pretalx File Read/Limited File Write (CVE-2023-28459, CVE-2023-28458)

[msutovsky-r7]

This PR adds modules for CVE-2023-28459 and CVE-2023-28458. Previously, modules have been split into separate PRs (#20413, #20404), it makes more sense to have them in one PR together as they both exploit similar functionality.

Vulnerable Application

Pretalx is a web-based conference planning tool, used to manage call for paper submissions, talk selection and so on. It used by many major IT conferences - such as OffensiveCon, Hexacon,... Versions 2.3.1 and prior are vulnerable to arbitrary file read, which exploits unsanitized path in schedule export. The module requires set of credentials of Pretalx user and Pretalx needs to have existing conference, where the attacker can submit malicious proposal.

Installation steps:

1. git clone https://github.com/pretalx/pretalx-docker.git
2. Change content of docker-compose.yml to following:

services:
  pretalx:
    image: pretalx/standalone:v2.3.1
      # image: pretalx/dev
    # build: .
    container_name: pretalx
    restart: unless-stopped
    depends_on:
      - redis
      - db
    environment:
      # Hint: Make sure you serve all requests for the `/static/` and `/media/` paths when debug is False. See [installation](https://docs.pretalx.org/administrator/installation/#step-7-ssl) for more information
      PRETALX_FILESYSTEM_MEDIA: /public/media
      PRETALX_FILESYSTEM_STATIC: /public/static
    ports:
      - "80:80"
    volumes:
      - ./conf/pretalx.cfg:/etc/pretalx/pretalx.cfg:ro
      - pretalx-data:/data
      - pretalx-public:/public
  db:
    image: docker.io/library/postgres:15-alpine
    container_name: pretalx-db
    restart: unless-stopped
    volumes:
      - pretalx-database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: veryunsecureplschange # same password as one that you will put in pretalx.cfg file later on
      POSTGRES_USER: pretalx
      POSTGRES_DB: pretalx
  redis:
    image: redis:latest
    container_name: pretalx-redis
    restart: unless-stopped
    volumes:
      - pretalx-redis:/data
volumes:
  pretalx-database:
  pretalx-data:
  pretalx-public:
  pretalx-redis:

1. sudo docker-compose up
2. Setup username and password
3. Go to orga/event/
4. Create new conference
5. Go to orga/event/[conference name]/schedule/rooms/
6. Create a room
7. Go to orga/event/[conference name]/
8. Make conference go live
9. sudo docker exec -u 0 -it pretalx /bin/bash
10. Make sure you have correct right on /data folder, so pretalx user can write export there

[github-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[cdelafuente-r7]

Suggested change

	fail_with(Msf::Exploit::Failure::NoAccess, 'Do not have privilege to admin, please provide correct credentials') unless res&.code == 200
	fail_with(Msf::Exploit::Failure::Unknown, 'Something went wrong') unless res
	fail_with(Msf::Exploit::Failure::NoAccess, 'Do not have privilege to admin, please provide correct credentials') unless res.code == 200

[cdelafuente-r7]

It might return a Rex::Version instead?

[cdelafuente-r7]

Suggested change

	return false unless res&.code == 302
	true
	res&.code == 302

[cdelafuente-r7]

Suggested change

	proposal_info[:description] || ''
	description = proposal_info[:description] || ''

[cdelafuente-r7]

Please, can you reformat this into multiple lines?

[cdelafuente-r7]

Suggested change

'Description' => 'This module exploits functionality in Pretalx that export conference schedule as zipped file. The Pretalx will iteratively include any file referenced by any HTML tag and does not properly check the path of the file, which can lead to arbitrary file read. The module requires crendetials that allow schedule export, schedule release and approval of proposals. Additionaly, module requires conference name and URL for media files.',

'Description' => 'This module exploits functionality in Pretalx that export conference schedule as zipped file. The Pretalx will iteratively include any file referenced by any HTML tag and does not properly check the path of the file, which can lead to arbitrary file read. The module requires credentials that allow schedule export, schedule release and approval of proposals. Additionally, module requires conference name and URL for media files.',

[cdelafuente-r7]

This option doesn't seem to used.

Suggested change

OptString.new('FILE_CONTENT', [false, 'Content to overwritten file']),

[cdelafuente-r7]

Suggested change

cookie_jar.clear

[bwatters-r7]

Release Notes

Adds two modules: one remote exploitation module targeting CVE-2023-28458, an authenticated limited file write, and a second auxiliary scanner module targeting CVE-2023-28459, an authenticated file read vulnerability.