来源

关联漏洞

描述

CVE-2022-29464 PoC for WSO2 products

介绍

# Better CVE-2022-29464

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. 
<br><br>


## Usage
```
python3 main.py https://example.com shell.jsp
```
Replace `https://example.com` with the vulnerable server and `shell.jsp` with a filename you want to use for upload.<br><br>
Edit `shell.jsp` file as you want, but current shell works just fine too (better than other JSP shells, at least).<br>
This shell can harvest output from stdout and stderr. CMDs are ran using `/bin/sh`.





## Exposure
Mostly, sysadmins run WSO2 products as superuser. Using this exploit, you'll have **superuser permissions** over the whole system. 

Database files are located at ~/repository/database directory.
* username: **wso2carbon**
* password: **wso2carbon**
* DBMS: **H2 1.4.196**


You can use the IntelliJ IDEA to open H2 type databases, [like this.](https://medium.com/@smartsplash/accessing-the-h2-database-for-wso2-products-c5d44b2f5590)



## Download files from the server

Using this exploit, you can copy any file from any directory to `~/repository/deployment/server/webapps/authenticationendpoint`. `authenticationendpoint` directory serves JSP, but can be used to serve other files too. 

Example:


```
cp ~/repository/database/WSO2CARBON_DB.h2.db ~/repository/deployment/server/webapps/authenticationendpoint/WSO2CARBON_DB.h2.db
```
This command will copy the main DB file to a directory we can use to download it from.




## Vulnerable products
* API Manager - 2.2.0 and above
* Identity Server - 5.2.0 and above (tested)
* Identity Server Analytics - 5.4.0, 5.4.1, 5.5.0, 5.6.0
* Identity Server as Key Manager - 5.3.0 and above
* Enterprise Integrator - 6.2.0 and above



## Disclaimer
I'm not responsible for any kind of thermonuclear war or you getting arrested. Use this exploit in a testing environment only.

文件快照

 [4.0K]  /data/pocs/2f0d3ed29caccbf967852f82329bea5ebb760367
├── [ 948]  main.py
├── [2.0K]  README.md
└── [1.1K]  shell.jsp

0 directories, 3 files

备注