GithubHelp home page GithubHelp logo

manuelz120 / cve-2022-23940 Goto Github PK

View Code? Open in Web Editor NEW
9.0 9.0 6.0 154 KB

PoC for CVE-2022-23940

Home Page: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23940

License: MIT License

Python 100.00%
cve insecure-deserialization owasp-top-ten python3 rce remote-code-execution security suitecrm

cve-2022-23940's Issues

Docker SuiteCRM PostInstallation TimeOut Error

Description

I tried to build up this environment by docker compose , but I encounter the postInstallation errors below. Any assistance which you might be able to provide with the below issues is much appreciated. Thanks!

Describe the results you received:
When I execute the command

sudo docker-compose up

It seemed to stuck in the line for more than 10 minutes

suitecrm_1  | suitecr INFO  ==> Installing suitecrm. It
could take some minutes...

After a few minutes, it shows the error message

Error executing 'postInstallation': Timeout: did not get to load all resources on this page
vulnerable_suitecrm_1 exited with code 1

here is the whole output

Attaching to vulnerable_mariadb_1, vulnerable_suitecrm_1
suitecrm_1  | 
suitecrm_1  | Welcome to the Bitnami suitecrm container
suitecrm_1  | Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-suitecrm
suitecrm_1  | Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-suitecrm/issues
suitecrm_1  | 
suitecrm_1  | WARN  ==> You set the environment variable ALLOW_EMPTY_PASSWORD=yes. For safety reasons, do not use this flag in a production environment.
mariadb_1   | mariadb 08:27:22.44 
mariadb_1   | mariadb 08:27:22.45 Welcome to the Bitnami mariadb container
mariadb_1   | mariadb 08:27:22.45 Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-mariadb
mariadb_1   | mariadb 08:27:22.45 Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-mariadb/issues
mariadb_1   | mariadb 08:27:22.45 
mariadb_1   | mariadb 08:27:22.46 INFO  ==> ** Starting MariaDB setup **
mariadb_1   | mariadb 08:27:22.48 INFO  ==> Validating settings in MYSQL_*/MARIADB_* env vars
mariadb_1   | mariadb 08:27:22.49 WARN  ==> You set the environment variable ALLOW_EMPTY_PASSWORD=yes. For safety reasons, do not use this flag in a production environment.
mariadb_1   | mariadb 08:27:22.49 INFO  ==> Initializing mariadb database
mariadb_1   | mariadb 08:27:22.51 INFO  ==> Updating 'my.cnf' with custom configuration
mariadb_1   | mariadb 08:27:22.52 INFO  ==> Setting user option
mariadb_1   | mariadb 08:27:23.24 INFO  ==> Setting slow_query_log option
mariadb_1   | mariadb 08:27:23.47 INFO  ==> Setting long_query_time option
mariadb_1   | mariadb 08:27:23.74 INFO  ==> Installing database
mariadb_1   | mariadb 08:27:54.10 INFO  ==> Starting mariadb in background
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Using Linux native AIO
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Uses event mutexes
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Number of pools: 1
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Using SSE2 crc32 instructions
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: Completed initialization of buffer pool
mariadb_1   | 2022-05-19  8:27:54 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: 128 out of 128 rollback segments are active.
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: Creating shared tablespace for temporary tables
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: Waiting for purge to start
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: 10.3.34 started; log sequence number 1625713; transaction id 20
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: Loading buffer pool(s) from /bitnami/mariadb/data/ib_buffer_pool
mariadb_1   | 2022-05-19  8:27:55 0 [Note] InnoDB: Buffer pool(s) load completed at 220519  8:27:55
mariadb_1   | 2022-05-19  8:27:55 0 [Note] Plugin 'FEEDBACK' is disabled.
mariadb_1   | 2022-05-19  8:27:55 0 [Note] Server socket created on IP: '127.0.0.1'.
mariadb_1   | 2022-05-19  8:27:55 0 [Warning] 'user' entry 'root@4f80f6dd8e2f' ignored in --skip-name-resolve mode.
mariadb_1   | 2022-05-19  8:27:55 0 [Warning] 'user' entry '@4f80f6dd8e2f' ignored in --skip-name-resolve mode.
mariadb_1   | 2022-05-19  8:27:55 0 [Warning] 'proxies_priv' entry '@% root@4f80f6dd8e2f' ignored in --skip-name-resolve mode.
mariadb_1   | 2022-05-19  8:27:55 0 [Note] Reading of all Master_info entries succeeded
mariadb_1   | 2022-05-19  8:27:55 0 [Note] Added new Master_info '' to hash table
mariadb_1   | 2022-05-19  8:27:55 0 [Note] /opt/bitnami/mariadb/sbin/mysqld: ready for connections.
mariadb_1   | Version: '10.3.34-MariaDB'  socket: '/opt/bitnami/mariadb/tmp/mysql.sock'  port: 3306  Source distribution
mariadb_1   | mariadb 08:27:56.28 INFO  ==> Configuring authentication
mariadb_1   | 2022-05-19  8:27:56 10 [Warning] 'proxies_priv' entry '@% root@4f80f6dd8e2f' ignored in --skip-name-resolve mode.
mariadb_1   | mariadb 08:27:56.46 INFO  ==> Running mysql_upgrade
mariadb_1   | 2022-05-19  8:28:08 27 [Warning] 'proxies_priv' entry '@% root@4f80f6dd8e2f' ignored in --skip-name-resolve mode.
mariadb_1   | find: '/docker-entrypoint-startdb.d/': No such file or directory
mariadb_1   | mariadb 08:28:08.43 INFO  ==> Stopping mariadb
mariadb_1   | 2022-05-19  8:28:08 0 [Note] /opt/bitnami/mariadb/sbin/mysqld (initiated by: unknown): Normal shutdown
mariadb_1   | 2022-05-19  8:28:08 0 [Note] InnoDB: FTS optimize thread exiting.
mariadb_1   | 2022-05-19  8:28:08 0 [Note] Event Scheduler: Purging the queue. 0 events
mariadb_1   | 2022-05-19  8:28:09 0 [Note] InnoDB: Starting shutdown...
mariadb_1   | 2022-05-19  8:28:09 0 [Note] InnoDB: Dumping buffer pool(s) to /bitnami/mariadb/data/ib_buffer_pool
mariadb_1   | 2022-05-19  8:28:09 0 [Note] InnoDB: Buffer pool(s) dump completed at 220519  8:28:09
mariadb_1   | 2022-05-19  8:28:10 0 [Note] InnoDB: Removed temporary tablespace data file: "ibtmp1"
mariadb_1   | 2022-05-19  8:28:11 0 [Note] InnoDB: Shutdown completed; log sequence number 1625722; transaction id 25
mariadb_1   | 2022-05-19  8:28:11 0 [Note] /opt/bitnami/mariadb/sbin/mysqld: Shutdown complete
mariadb_1   | 
mariadb_1   | 
mariadb_1   | mariadb 08:28:11.56 INFO  ==> ** MariaDB setup finished! **
mariadb_1   | mariadb 08:28:11.74 INFO  ==> ** Starting MariaDB **
mariadb_1   | 2022-05-19  8:28:12 0 [Note] /opt/bitnami/mariadb/sbin/mysqld (mysqld 10.3.34-MariaDB) starting as process 1 ...
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Using Linux native AIO
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Uses event mutexes
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Number of pools: 1
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Using SSE2 crc32 instructions
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Completed initialization of buffer pool
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: 128 out of 128 rollback segments are active.
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Creating shared tablespace for temporary tables
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Waiting for purge to start
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: 10.3.34 started; log sequence number 1625722; transaction id 20
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Loading buffer pool(s) from /bitnami/mariadb/data/ib_buffer_pool
mariadb_1   | 2022-05-19  8:28:12 0 [Note] InnoDB: Buffer pool(s) load completed at 220519  8:28:12
mariadb_1   | 2022-05-19  8:28:13 0 [Note] Plugin 'FEEDBACK' is disabled.
mariadb_1   | 2022-05-19  8:28:13 0 [Note] Server socket created on IP: '0.0.0.0'.
mariadb_1   | 2022-05-19  8:28:13 0 [Warning] 'proxies_priv' entry '@% root@4f80f6dd8e2f' ignored in --skip-name-resolve mode.
mariadb_1   | 2022-05-19  8:28:14 0 [Note] Reading of all Master_info entries succeeded
mariadb_1   | 2022-05-19  8:28:14 0 [Note] Added new Master_info '' to hash table
mariadb_1   | 2022-05-19  8:28:14 0 [Note] /opt/bitnami/mariadb/sbin/mysqld: ready for connections.
mariadb_1   | Version: '10.3.34-MariaDB'  socket: '/opt/bitnami/mariadb/tmp/mysql.sock'  port: 3306  Source distribution
suitecrm_1  | suitecr INFO  ==> Configuring Database...
suitecrm_1  | mysql-c INFO  Trying to connect to MySQL server
suitecrm_1  | mysql-c INFO  Found MySQL server listening at mariadb:3306
suitecrm_1  | mysql-c INFO  MySQL server listening and working at mariadb:3306
suitecrm_1  | suitecr INFO  ==> Configuring silent installation
suitecrm_1  | suitecr INFO  ==> Installing suitecrm. It could take some minutes...
suitecrm_1  | Error executing 'postInstallation': Timeout: did not get to load all resources on this page
vulnerable_suitecrm_1 exited with code 1

Additional information you deem important (e.g. issue happens only occasionally):

Version

  • Output of sudo docker version
Client:
 Version:           20.10.14+dfsg1
 API version:       1.41
 Go version:        go1.18.1
 Git commit:        a224086
 Built:             Sun May  1 19:59:40 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.14+dfsg1
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.1
  Git commit:       87a90dc
  Built:            Sun May  1 19:59:40 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.2~ds1
  GitCommit:        1.6.2~ds1-1+b1
 runc:
  Version:          1.1.1+ds1
  GitCommit:        1.1.1+ds1-1+b1
 docker-init:
  Version:          0.19.0
  GitCommit:
  • Output of sudo docker info
Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 3
 Server Version: 20.10.14+dfsg1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runtime.v1.linux runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 1.6.2~ds1-1+b1
 runc version: 1.1.1+ds1-1+b1
 init version: 
 Security Options:
  apparmor
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.16.0-kali7-amd64
 Operating System: Kali GNU/Linux Rolling
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 1.935GiB
 Name: kali
 ID: 252K:I2MD:ICMJ:PLKL:T34E:5L6A:DTNK:N2TU:OKH7:UK5H:UD2N:4MEX
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Additional environment details (AWS, VirtualBox, Docker for MAC, physical, etc.):
I have tried on both Ubuntu and Kali

  • Ubuntu Desktop 20.04 LTS
  • Kali (in Virtualbox)

Additional things I tried:
[Reference] https://github.com/bitnami/bitnami-docker-suitecrm/issues/58

  • I tried adding this environment parameter in docker-compose.yml
    SUITECRM_HTTP_TIMEOUT=1200
    but it didn't work.

  • Also tried cleaning docker by removing exited containers and pruning those volumes. No luck yet.:
    sudo docker rm $(sudo docker ps -a -f status=exited -q)
    sudo docker volume prune

Not Working exploit

I trying test exploit on suitecrm 7.11.8 with php7.3, but it's not working.
I see 2 problems:

  1. is_array check fails
  2. The data is serialized as a string and deserialized accordingly.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.