CVE-2023-34096: Path Traversal Vulnerability in Thruk Monitoring Web Interface

Important Note: All of the findings listed here were previously reported to the manufacturer of the software.

As part of the responsible disclosure policy, we waited for a response of the manufacturer (confirming the vulnerability, issuing a patch, or accepting that they won't solve the finding) before sharing this post.

Introduction

During a Penetration Test performed to a Security Company I was able to identify certain findings that could affect the popular Thruk Monitoring Web Interface. So, after analyzing the GitHub repository and performing some tests on the target environment, I was able to identify and exploit the vulnerabilities, then I reported these issues to the manufacturer.

Summary

The file panorama.pm is vulnerable to a Path Traversal Vulnerability which allows a remote authenticated attacker to upload arbitrary files to any folder which has write permissions on the affected system. This vulnerability affects all versions of Thruk even the one that was recently published (<=3.06) in May 24, 2023.

Details

The parameter "location" is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (.) and the slash (/).

This was verified by analyzing in detail the GitHub repository and the source files.

In this step, the location is received from the parameters sent by the client through the web request and there is no sanitization at all.

Then, the variable folder is constructed doing a basic concatenation without any sanitization.

Next, the folder variable is concatenated with the filename and its result is stored in the newlocation variable, again no sanitization at all.

Finally, here the uploaded file is moved to the desired folder.

Through this flow, it is easy to see that due to the lack of sanitization we can manipulate the location parameter and exploit a Path Traversal vulnerability to upload a file to any folder we want.

Proof of Concept (PoC)

1. Go to the form where we can upload an image that will be used as background for a Dashboard.
2. Select any file with the allowed extensions and intercept the request with Burp Suite.
3. Modify the location parameter which is the backgrounds/ string and replace it with something like backgrounds/../../../../tmp/
4. You will receive a message that the file was uploaded successfully.
5. Check your /tmp/ folder and verify the presence of the file.

As part of the PoC, I decided to include the following screenshots.

Normal Case

In this first screenshot I included the normal request where a file will be uploaded to a folder where the current user does not have any write permissions, and I received an error message.

Path Traversal Exploitation

In this second screenshot I included the manipulated request where the path traversal vulnerability is being exploited to upload the file to /tmp/ folder, as you can see I received a success message.

CVSS

The NIST NVD assigned a CVSS 3.1 Score of 8.8 (High) to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The CNA GitHub, Inc. assigned a CVSS 3.1 Score of 6.5 (Medium) to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Check NIST NVD for further details.

Impact

A Path Traversal vulnerability allows an attacker to upload arbitrary files to the server. The attacker can overwrite existing files on the system and cause a defacement (replacing legitimate images on the web server) or simply can upload random files to fill the disk completely and affect the availability and correct status of the platform.

It is well known that a Path Traversal Vulnerability in certain cases can allow an attacker to upload a webshell and gain Remote Code Execution (RCE) on the affected host, which could lead to a Complete System Takeover.

This vulnerability affects all versions of Thruk even the one that was published 15 days ago (3.06) in May 24, 2023; so the impact is bigger as this issue affects all instances of Thruk around the world.

This was reported through a Security Advisory via GitHub. You can find the security advisory report and other useful references in the following links:

1. https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994h
2. https://github.com/galoget/Thruk-CVE-2023-34096
3. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34096
4. https://www.exploit-db.com/exploits/51509
5. https://packetstormsecurity.com/files/172822/Thruk-Monitoring-Web-Interface-3.06-Path-Traversal.html
6. https://nvd.nist.gov/vuln/detail/CVE-2023-34096
7. https://cve.report/CVE-2023-34096
8. https://vulmon.com/vulnerabilitydetails?qid=CVE-2023-34096&scoretype=cvssv3
9. https://vuldb.com/?id.231110
10. https://twitter.com/CVEnew/status/1666897976894054415
11. https://www.thruk.org/changelog.html#_v3-062

Vulnerability Summary

• Assigned CVE: CVE-2023-34096
• CVE Author: Galoget Latorre (@galoget)
• Severity (NIST): 8.8 High
• Severity (GitHub): 6.5 Medium
• Type: Path Traversal
• Product: Thruk Monitoring Web Interface
• Affected Versions: All versions <= 3.06
• Patched Version: 3.06-2

Timeline

• 2023-05-25: This vulnerability was identified by Galoget Latorre.
• 2023-06-02: Initial contact with maintainer via GitHub Security Advisory including vulnerability details and Proof of Concept (PoC).
• 2023-06-05: CVE-2023-34096 is assigned. 
• 2023-06-06: Maintainer releases a patch with version 3.06-2, see Thruk's Changelog.
• 2023-06-08: GitHub Security Advisory is released by maintainer.
• 2023-06-08: Security advisory (this blog post) is released by Galoget Latorre.
• 2023-06-08: Exploit PoC is released by Galoget Latorre.
• 2023-06-09: Exploit PoC is shared by Exploit Database (Exploit-DB).
• 2023-06-09: Exploit PoC is shared by Packet Storm Security.

Credits

This security vulnerability was identified by Galoget Latorre, Security Consultant (Pentester) at Hackem Cybersecurity Research Group and Dreamlab Technologies.

Read More

Cracking Passwords: Brute-force Attack with Hydra (CLI) + xHydra (GTK)

Recently on Security StackExchange, I saw a lot of people asking how to use properly THC Hydra for Password Cracking, so in this post I'm going to explain how to install the command line utility, and also how to install the graphical user interface (GUI) for it. Then you can find step by step instructions on how to use this tool properly to attack an http-form-post that simulates a Login form for a corporate website. Hope you enjoy this post as much as I did when I was writing it.

Read More

Blitz CTF 001 Writeup (Step by Step Solutions) [CTF365]

A few days ago, we received an invitation to the BlitzCTF001, a very short and fast cybersecurity CTF. The challenges contained in this CTF covers: Crypto (Encoding), SQLi, Broken Access Control, Session Manipulation and Steganography.

In our opinion, the challenges are interesting and entertaining, especially to learn about web application security, so we decided to share the solutions (just in case that you got stuck in some level), hope you like and enjoy them as we did.

Read More

How can you be fooled by the U+202E trick?

A common technique, used by malicious attackers to fool their victims, is using the Unicode special character U+202E known as an annulment from right to left to make the malicious file appears as a PDF document instead of a potentially dangerous executable file.

To understand this concept, let's imagine that our malicious file is "document.exe" (see Figure 1):

Figure 1: Malicious file recently created with no changes.

Now we are going to follow the steps below to accomplish our goal:

• Open the Windows Character Map (Start, Run, charmap)
• Find and Copy the Unicode character U+202E. Notice that at the bottom left shows the ASCII value of the characters (see Figure 2).

Figure 2: Charmap with U+202E selected and copied.

• Paste (Ctrl + V) the character just before the extension point: "document[[U+202E]].exe"
• Enter the extension that you want but in reverse, for example, if we want "doc", we need to write "cod", or if we want "pdf", then we need to write "fdp".

The result will be something like the file shown in Figure 3.

Figure 3: Malicious file renamed with the special character.

(The real name of the file without the special character should be: "documentfdp.exe")

Finally, to perfect the infection vector, a good idea would be to change the icon of the malicious file and also use a name that can trick the user, considering that the "exe" or the original extension must remain. E.g.:

Figure 4: Malicious file disguised as a Microsoft Word file, with a tricky name in order to preserve the original extension and fool the user.

The malicious file is ready to be delivered to the target and the following happens:

Figure 5: Common Infection Flow (TrendMicro)

If the victim executes the malware (Double Click or Enter), the following screen would appear:

Figure 6: Malicious File starts a command prompt and shows a message: "Hello World".

Now, let's look at the title of the shell: "annexe.doc", apparently our technique is almost perfect because we can't see the original extension even in the command line, or we can?

Possible Countermeasures:

• If we try to rename the file (F2), we will see something strange, this effect is produced by the special character, so this is a clue to realize that something is wrong.
• If you are in a GNU/Linux based system, you can check the headers of the file with some commands.
• Another trick that you can use to verify the name of any file and its extension could be using the command prompt, but how?

To prove this theory we need to open a new "cmd.exe" in the location of the suspicious file, after that, we write the first two characters of the name and press "Tab", the system will autocompletes the true name, then we will know the truth!! (See Figure 7).

Figure 7: Revealing the true name of the suspicious file and executing it.

As shown in Figure 7, the name of the file has (one or more) strange characters that aren't recognized and are shown as 2 question marks, revealing the presence of the "U+202E" character, that's all, hope you like this post. =)

Source of Figure 5: http://blog.trendmicro.es/bot-zeus-y-conexion-kneber/

Read More