Papercut ng mf CVE-2023-27350 #338

Isaac-GC · 2023-08-21T06:50:35Z

Papercut NG/MF Authentication Bypass and RCE Detector

Summary

The detector is intended to be more simplified and focus primarily on the authentication bypass. This is to stay aligned with the goal of the Tsunami Security Scanner by being simple, quick, and accurate.

While this detector does not specifically detect for RCE, it looks for the initial authentication bypass (falls under the same CVE) that is then used to perform the RCE. To do this, it requests/navigates to <root_webserver_url>/app?service=page/SetupCompleted, where one of two events may happen:

[ isVulnerable ] The URL/webpage loads with an HTTP response code of 200 and the text Configuration Wizard : Setup Complete is present. If this is seen, an attacker is capable of logging in as Admin and performing the RCE
[ notVulnerable ] The URL/webpage redirects the user with a HTTP response code of 302, followed by a 200 and a webpage where the user is forced to log in

Testing

Images and OCI image sources to test this plugin can be found at:
https://github.com/Isaac-GC/papercut_ng_mf_docker_images

These images simulate a near realistic production environment and are prebuilt/preconfigured to let you get started ASAP.
They currently consist of two version types:

Vulnerable
- ghcr.io/isaac-gc/papercut_ng_mf:19.2.7.62195
- ghcr.io/isaac-gc/papercut_ng_mf:20.1.4.57927
- ghcr.io/isaac-gc/papercut_ng_mf:21.2.10.62186
- ghcr.io/isaac-gc/papercut_ng_mf:22.0.1.62695
Non-vulnerable (patched)
- ghcr.io/isaac-gc/papercut_ng_mf:20.1.8.66704
- ghcr.io/isaac-gc/papercut_ng_mf:21.2.12.66701
- ghcr.io/isaac-gc/papercut_ng_mf:22.0.12.66453

Using the images

Pull down an OCI image for the version you want to use/test.
- i.e. docker pull ghcr.io/isaac-gc/papercut_ng_mf:22.0.1.62695
Run the container using docker, kubernetes, or another OCI compatible engine
- I.e. using docker: docker run -it --rm -p 80:80 ghcr.io/isaac-gc/papercut_ng_mf:22.0.1.62695
Thats it!

Isaac-GC · 2023-10-16T15:08:30Z

Hi @maoning !

This PR has been open for a couple months. Just wanted to check if everything was okay with it or if there were any changes you needed me to make!

Thanks! :)

...E_2023_27350/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFVulnDetector.java

maoning · 2023-11-01T20:44:34Z

@Isaac-GC Sorry for the delay, the main comment I had in the review is about testing the real code execution in the plugin. I would like to see this plugin merged in before end of the year. Once you have the updated version, I will try to finish the review asap.

maoning · 2023-11-07T14:28:10Z

@Isaac-GC I have patched in your plugin and tested against the vulnerable container you provided, your plugin doesn't report the vulnerability as expected. There are 2 main issues after some debugging:

Your plugin is expecting a web service returned from nmap for the papercut service. However my local nmap returns tcp service instead which triggers isWebService to return false, so the core detection logic is skipped. As a result of being a tcp service, buildWebApplicationRootUrl would crash the plugin, so the application root url has to be manually constructed.

Could you double check on your end to verify the nmap output (from a local Tsunami run). If your nmap does return http service, could you let me know your nmap version? I'm curious about the differences in our nmap output.

For the core detection logic, I see that you pulled JSESSION_ID from the cookie and used it throughout all the later network requests. However, the set-cookie value may changes per request, and the cookie field for the subsequent request needs to be updated in order to get successful response from the server. I would recommend you to check if set-cookie field from each response is non-empty, if it is present, then copy over the value to the cookie for the next request.

Also, please test out the plugin with a local instance of the callback server and verify the detector works e2e (triggering callback interaction and reporting a vulnerability). Let me know if you have any issue configuring the callback server with your Tsunami instance.

...0/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFVulnDetectorWithPayload.java

maoning · 2023-11-22T22:40:55Z

@Isaac-GC Let me know if you have further questions about the comments and if there's any issue with callback server usage. I would like to have your plugin merged soon :)

Isaac-GC · 2023-11-28T21:26:33Z

Hi @maoning, apologies on the delay!

I just pushed the latest version of the code and should be good to be tested on your side. (I confirmed it worked as expected with all of the vulnerable papercut versions). The PR summary was also updated to reflect a change in the ports used by the docker containers. Instead of using the default port of 9191, I modified the server properties to have the container port instead be reflected as 80 (which is a more real world scenario, albeit without HTTPS just for testing purposes)

There were some issues encountered that were primarily session based (see the below summary) and some issues with how the parameter strings were handled built from the initial push. But everything seems to be working now :)

If possible or if you would think it is beneficial, please consider adding ability to use the CookieJar implementation from the OkHttp library as one of the capabilities for the client connection. While this plugin may be an edge-case in regards to using/needing session management, I still feel having that potentially being added into the Tsunami Scanner will greatly increase the overall capabilities/possibilities for the tool. LMK your thoughts on this!

Thanks! :)

Adding this here for anyone in the future that may review this pull request or reference this CVE:

Upon connecting to the application initially with the /app?service=page/SetupCompleted, you are provided a JSESSION_ID cookie. During subsequent connections, the JSESSION_ID may be updated with a new iterated version (i.e. abc009 -> abc010).
If saving the cookies or using a tool that uses session management, such as python requests, the JSESSION_ID cookie will be updated for you. If you are using the OkHttp library, it is recommended to use the OkHttp CookieJar implementation with the client if possible.

To handle the url path parameters in clear/easy way when using the OkHTTP library, please reference Line 110 in PapercutNGMFHelper.class

Isaac-GC · 2023-12-13T17:02:22Z

Hey @maoning!

I know you said you wanted to merge the plug-in soon, just wanted to check if there were any issues on you encountered or any changes you'd like to me to make!

Thanks!

maoning · 2023-12-20T22:22:55Z

Thanks @Isaac-GC for the wait as well as your detailed response, supporting the cookie jar feature from okhttp in Tsunami is a great idea! I will track it as a feature request for Tsunami.

I have re-tested your updated plugin, everything is working well now. I will leave some comment about the minor styling issues in the code review for future references. For the sake of the time, I will merge in your code and fix them up quickly on my side.

We have recently updated our patch reward tracking workflow. Could you resubmit this plugin via the form at https://bughunters.google.com/report/tsunami? The reward is expected to be distributed 2-3 weeks after the code merge (slightly delayed by the holidays).

maoning

The directory should be named with all lower case letters papercut_ng_mf_cve_2023_27350. The java class name should be all in camel case, PapercutNgMfHelper for instance.

maoning · 2023-12-20T22:25:11Z

..._mf_CVE_2023_27350/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFHelper.java

+  public String JSESSION_ID = "";
+  private String root_url = "";
+  private String base_app_url = "";


Minor styling issue: these should all be in camel case, match pattern '^[a-z][a-zA-Z0-9]*_?$'. [MemberName]

Only the static variables are in capitalized format with underscores.

maoning · 2023-12-20T22:25:44Z

..._mf_CVE_2023_27350/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFHelper.java

+    headers.addHeader("Accept", "*/*");
+
+    // Add content-type helper
+    if (isPostRequest) headers.addHeader("Content-Type", "application/x-www-form-urlencoded");


Styling nit: add curly brackets for if/else statement.

maoning · 2023-12-20T22:26:03Z

..._mf_CVE_2023_27350/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFHelper.java

+    try {
+      response = this.httpClient.send(request, this.networkService);
+      this.updateJsessionId(response); // Update JSESSION_ID if needed
+      this.previousUrl = (this.base_app_url);


remote bracket

maoning · 2023-12-20T22:28:43Z

...0/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFVulnDetectorWithPayload.java

+
+      // Post/send above params
+      helper.sendPostRequest(helper.buildParameterString(setupCompletedPage));
+      //      helper.sendGetRequest("service=page/Dashboard");


Remove debug comment

maoning · 2023-12-20T22:32:09Z

...c/test/java/com/google/tsunami/plugins/papercut/PapercutNGMFVulnDetectorWithPayloadTest.java

+  }
+
+  @Test
+  public void detect_whenVulnerable_returnsVulnerability() throws IOException {


There should be a test for detection without callback server.

Isaac-GC added 6 commits June 3, 2023 12:00

Adding PaperCut NG/MR vulnDetector

eb2f4da

Merge branch 'google:master' into master

b72003a

Merge branch 'google:master' into master

39f901c

Added source files

aa55d05

Fixed typo in name

79f48dd

Updated README and vuln descriptions

fdaaf91

Isaac-GC mentioned this pull request Aug 21, 2023

PRP: CVE-2023-27350 -- PaperCut NG/MR RCE #323

Closed

Isaac-GC added 2 commits August 22, 2023 12:32

Formatting to codestyle

bbca213

applied google code formatting

331cb29

maoning self-requested a review November 1, 2023 20:09

maoning reviewed Nov 1, 2023

View reviewed changes

Isaac-GC added 3 commits November 2, 2023 08:52

added RCE capabilities (tests don't fully work yet)

5072e99

Finished RCE with payload tests --> All Green from local dev side

bb03e03

Applied Google Code style formatting

cdb0dc7

Isaac-GC commented Nov 7, 2023

View reviewed changes

...0/src/main/java/com/google/tsunami/plugins/papercut/PapercutNGMFVulnDetectorWithPayload.java Outdated Show resolved Hide resolved

maoning self-assigned this Nov 27, 2023

Added helper class and tested

e98afbd

formatted with Google code style to latest commit

73e529b

maoning reviewed Dec 20, 2023

View reviewed changes

copybara-service bot merged commit e43f2d2 into google:master Dec 20, 2023
5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Papercut ng mf CVE-2023-27350 #338

Papercut ng mf CVE-2023-27350 #338

Isaac-GC commented Aug 21, 2023 •

edited

Loading

Isaac-GC commented Oct 16, 2023

maoning commented Nov 1, 2023

maoning commented Nov 7, 2023 •

edited

Loading

maoning commented Nov 22, 2023

Isaac-GC commented Nov 28, 2023 •

edited

Loading

Isaac-GC commented Dec 13, 2023

maoning commented Dec 20, 2023

maoning left a comment

maoning Dec 20, 2023

maoning Dec 20, 2023

maoning Dec 20, 2023

maoning Dec 20, 2023

maoning Dec 20, 2023

Papercut ng mf CVE-2023-27350 #338

Papercut ng mf CVE-2023-27350 #338

Conversation

Isaac-GC commented Aug 21, 2023 • edited Loading

Papercut NG/MF Authentication Bypass and RCE Detector

Summary

Testing

Using the images

Isaac-GC commented Oct 16, 2023

maoning commented Nov 1, 2023

maoning commented Nov 7, 2023 • edited Loading

maoning commented Nov 22, 2023

Isaac-GC commented Nov 28, 2023 • edited Loading

Isaac-GC commented Dec 13, 2023

maoning commented Dec 20, 2023

maoning left a comment

Choose a reason for hiding this comment

maoning Dec 20, 2023

Choose a reason for hiding this comment

maoning Dec 20, 2023

Choose a reason for hiding this comment

maoning Dec 20, 2023

Choose a reason for hiding this comment

maoning Dec 20, 2023

Choose a reason for hiding this comment

maoning Dec 20, 2023

Choose a reason for hiding this comment

Isaac-GC commented Aug 21, 2023 •

edited

Loading

maoning commented Nov 7, 2023 •

edited

Loading

Isaac-GC commented Nov 28, 2023 •

edited

Loading