exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ForkCMS PHP Object Injection

ForkCMS PHP Object Injection
Posted Mar 12, 2021
Authored by Wolfgang Hotwagner | Site ait.ac.at

ForkCMS versions prior to 5.8.3 suffer from a PHP object injection vulnerability.

tags | exploit, php
advisories | CVE-2020-24036
SHA-256 | fc94d42d043e4a90dc4bd339643f8d95cc873f96e7f9dd33fb84c5094fc4b0a1

ForkCMS PHP Object Injection

Change Mirror Download
ForkCMS PHP Object Injection
=========================
| Identifier: | AIT-SA-20210215-04 |
| Target: | ForkCMS |
| Vendor: | ForkCMS |
| Version: | all versions below version 5.8.3 |
| CVE: | CVE-2020-24036 |
| Accessibility: | Remote |
| Severity: | Medium |
| Author: | Wolfgang Hotwagner (AIT Austrian Institute of Technology) |

SUMMARY
=========
[ForkCMS is an open source cms written in PHP.](https://www.fork-cms.com/)

VULNERABILITY DESCRIPTION
========================
PHP object injection in the Ajax-endpoint of the backend in ForkCMS below version 5.8.3 allows authenticated remote user to execute malicious code.

The ajax-callbacks for the backend use unserialize without restrictions or any validations. An authenticated user could abuse this to inject malicious PHP-Objects which could lead to remote code execution:

```
<?php

namespace Backend\Core\Ajax;

use Backend\Core\Engine\Base\AjaxAction as BackendBaseAJAXAction;

use Symfony\Component\HttpFoundation\Response;

/**

* This action will generate a valid url based upon the submitted url.

*/

class GenerateUrl extends BackendBaseAJAXAction

{

public function execute(): void

{

// call parent, this will probably add some general CSS/JS or other required files

parent::execute();

// get parameters

$url = $this->getRequest()->request->get('url', '');

$className = $this->getRequest()->request->get('className', '');

$methodName = $this->getRequest()->request->get('methodName', '');

$parameters = $this->getRequest()->request->get('parameters', '');

// cleanup values

$parameters = unserialize($parameters); // $B"+(B VULNERABLE CODE

// fetch generated meta url

$url = urldecode($this->get('fork.repository.meta')->generateUrl($url, $className, $methodName, $parameters));

// output

$this->output(Response::HTTP_OK, $url);

}

}
```

PROOF OF CONCEPT
=================
In order to exploit this vulnerability, an attacker has to be authenticated with least privileges. We tested this exploit with $B!H(BDashboard$B!I(B permissions.

For demonstration purposes we created a proof of concept exploit that deletes files and directories from the webserver. With more effort an attacker might also find a payload for executing a webshell. There are many gadgets available in the vendor directory for potential payloads.

The object-injection code for generating a payload might look as following:

```
'O:27:"Swift_KeyCache_DiskKeyCache":1:{s:4:"keys";a:1:{s:%d:"%s";a:1:{s:%d:"%s";s:9:"something";}}}' % (len(filepath),filepath,len(deletefile),deletefile)
```

VULNERABLE VERSIONS
===================
All versions including 5.8.1 are affected.

TESTED VERSIONS
===============
ForkCMS 5.8.1 (with Debian 10 and PHP 7.3.14-1)

IMPACT
======
An authenticated user with minimal privileges could execute malicious code.


MITIGATION
==========
Fork-5.8.3 fixed that issue

VENDOR CONTACT TIMELINE
========================
| 2020-05-01 | Contacting the vendor |
| 2020-06-08 | Vendor replied |
| 2020-07-07 | Vendor released an updated version |
| 2021-02-15 | Public disclosure |

ADVISORY URL
============
[https://www.ait.ac.at/ait-sa-20210215-04-poi-forkcms](https://www.ait.ac.at/ait-sa-20210215-04-poi-forkcms)


Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close