Description

RCE via the YAML configuration of reNgine. In this configuration, the settings of the tools used in scans can be adapted. This functionality can be abused to executy arbitrary code.

PoC

In the yaml configuration of reNgine, edit the extensions field of dir_file_search to make it look like this:

extensions: [";echo TEST1234"]

Then, start a scan with any scan engine that includes subdomain discovery and directory search. The subdomain scan must return valid, alive subdomains in order for the directory searching to begin. Then, watch the logs and the dirsearch usage should be printed, with TEST1234 echo'd multiple times in the logs.

Impact

An attacker can execute arbitrary commands on the system.

Suggested fix

Do not trust user controlled data and do not directly inject it into the command. You should check inputted extensions on an allowlist, and reject any which do not conform to the allow list.

Location

https://github.com/yogeshojha/rengine/blob/83e6d6716289212e611145ec68c32199e25a31e6/web/reNgine/tasks.py#L861

https://github.com/yogeshojha/rengine/blob/83e6d6716289212e611145ec68c32199e25a31e6/web/reNgine/tasks.py#L892

https://github.com/yogeshojha/rengine/blob/83e6d6716289212e611145ec68c32199e25a31e6/web/reNgine/tasks.py#L922