CVE-2023-46865 PoC — Crater 安全漏洞

Source

https://github.com/asylumdx/Crater-CVE-2023-46865-RCE

Associated Vulnerability

Title:Crater 安全漏洞 (CVE-2023-46865)
Description:Crater是Crater公司的一款开源网络和移动应用程序。用于跟踪费用、付款并创建专业发票和估算。 crater 6.0.6及之前版本存在安全漏洞，该漏洞源于允许超级管理员通过将代码放入image/png IDAT中来执行任意PHP代码。

Description

Crater <=6.0.6, CVE-2023-46865 Post-Auth RCE (Superadmin)

Readme

# Crater-CVE-2023-46865-RCE
Crater &lt;=6.0.6, CVE-2023-46865 Post-Auth RCE (Superadmin)

## Vulnerability Description

Crater Invoice is vulnerable to unrestricted file upload with dangerous type due to lack of proper input validation. The Base64Mime checking class can be bypassed by embedding a valid PHP payload into an IDAT image chunk. A user with superadmin privileges is able to upload the crafted payload through company logo at /api/v1/company/upload-logo.

## Usage

    $~ usage: python3 crater-rce.py --target TARGET --email EMAIL --password PASSWORD [--cmd CMD]
    $~ python3 crater-rce.py --target http://192.168.1.1 --email test@mail.com --password test1234 --cmd 'whoami'  

    $~ python3 crater-rce.py -h                                                                                                                                                                                       
    usage: crater-rce.py [-h] --target TARGET --email EMAIL --password PASSWORD [--cmd CMD]
    
    Crater Invoice RCE - CVE-2023-46865
    
    options:
      -h, --help           show this help message and exit
      --target TARGET      Target URL
      --email EMAIL        Email
      --password PASSWORD  Password
      --cmd CMD            Command to execute
      
## Tested on

    - Crater 6.0.6
    - Kali 6.1.0
    
## References
https://github.com/huntergregal/PNG-IDAT-Payload-Generator 

https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater.html

## Credit
[faisalfs10x](https://github.com/faisalfs10x) - for helping develop proof of concept.

## Disclaimer:

    The script is for security analysis and research only, hence I would not be liable if it is been used for illicit activities

File Snapshot


 [4.0K]  /data/pocs/4c998253c3d7ca400cbe4f373d17d41ae2a3b06d
├── [6.3K]  crater-rce.py
└── [1.7K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!