Authenticated Remote Code Execution Vulnerability

A3h1nt wrote: ↑

Mon May 13, 2024 4:57 am

I have found an authenticated remote code execution vulnerability on openCart project v4.0.2.3 in its edit theme functionality, which allows an authenticated admin user to execute arbitrary system commands, resulting in remote code execution. By default, the admin panel lacks any anti-bruteforce mechanism, making it easier for an attacker to bruteforce their way into the admin panel.

Severity : High
CVSS Score : 9.8
CVSS Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Version : 4.0.2.3

I would like to assist with fixing this bug, as edit theme functionality should only be used to edit themes and not execute system commands on the server.

A3h1nt wrote: ↑

Mon May 13, 2024 4:57 am

I have found an authenticated remote code execution vulnerability on openCart project v4.0.2.3 in its edit theme functionality, which allows an authenticated admin user to execute arbitrary system commands, resulting in remote code execution. By default, the admin panel lacks any anti-bruteforce mechanism, making it easier for an attacker to bruteforce their way into the admin panel.

Severity : High
CVSS Score : 9.8
CVSS Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Version : 4.0.2.3

I would like to assist with fixing this bug, as edit theme functionality should only be used to edit themes and not execute system commands on the server.

A3h1nt wrote: ↑

Mon May 13, 2024 4:57 am

I have found an authenticated remote code execution vulnerability on openCart project v4.0.2.3 in its edit theme functionality, which allows an authenticated admin user to execute arbitrary system commands, resulting in remote code execution. By default, the admin panel lacks any anti-bruteforce mechanism, making it easier for an attacker to bruteforce their way into the admin panel.

Severity : High
CVSS Score : 9.8
CVSS Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Version : 4.0.2.3

I would like to assist with fixing this bug, as edit theme functionality should only be used to edit themes and not execute system commands on the server.

straightlight wrote: ↑

Mon May 13, 2024 11:05 pm

Sure, if you believe there are identified bugs that needs to be address, you could address them on the Github Opencart repository: https://www.github.com/opencart/opencart 's issues tab if they have not yet been rectified in the OC v4.1.0.0 release already.

ADD Creative wrote: ↑

Mon May 13, 2024 11:41 pm

Sounds similar to https://github.com/opencart/opencart/issues/13863 which was sadly closed without fixing.

function twig_array_map(Environment $env, $array, $arrow)
{
    twig_check_arrow_in_sandbox($env, $arrow, 'map', 'filter');

    $r = [];
    foreach ($array as $k => $v) {
        $r[$k] = $arrow($v, $k);
    }

    return $r;
}

{# list all file names from current directory #}
{{ ['ls']|map('system')|join }}

{# get current user name #}
{{ ['whoami']|map('system')|join }}

JNeuhoff wrote: ↑

Tue May 14, 2024 8:52 pm

ADD Creative wrote: ↑

Mon May 13, 2024 11:41 pm

Sounds similar to https://github.com/opencart/opencart/issues/13863 which was sadly closed without fixing.

I might add that in principle, this is an issue with Symfony Twig, which hasn't implemented security restrictions for its arrow functions (better know as callables in PHP). For example, the system/storage/vendor/twig/twig/src/Extension/CoreExtension.php uses this for the map filter in line 1662:

Code: Select all

function twig_array_map(Environment $env, $array, $arrow)
{
    twig_check_arrow_in_sandbox($env, $arrow, 'map', 'filter');

    $r = [];
    foreach ($array as $k => $v) {
        $r[$k] = $arrow($v, $k);
    }

    return $r;
}

So almost any PHP function with 2 arguments could be invoked, such as

Code: Select all

{# list all file names from current directory #}
{{ ['ls']|map('system')|join }}

Code: Select all

{# get current user name #}
{{ ['whoami']|map('system')|join }}

The whole Symfony Twig templating system is of bloated poor quality, the authors won't even fix common operator precedence bugs. Twig should be a templating language only, it should not allow calling dangerous PHP functions such as system or exec etc.