Microweber - Exploiting a Zip Slip

Introduction

Microweber is an open-source content management system (CMS) that aims to simplify building websites with a drag and drop interface. It’s a PHP-based CMS with built-in blogging and e-commerce capabilities. Microweber also has a modular expansion system which, along with other features, is managed via an admin panel.

A directory traversal vulnerability was discovered in the Backup restore functionality, that allows an attacker to write arbitrary files to the file system in the web server’s user context via a specifically crafted zip file.

The Vulnerability

The zip slip vulnerability was discovered while exploring functionality within the Backup.php script. The related advisory summary can be found here.

In Backup.php on line 335, the path to the temporary zip extraction directory is defined within the current cache path of the application, and then passed in as the target_dir for extraction.

Following the execution path, the actual extraction of the zip occurs within the native_unzip method starting on line 185 of Unzip.php. The directory traversal attack occurs is on line 240 of Unzip.php, where the $target_file_to_save variable is defined.

Zip files allow file names to be defined somewhat arbitrarily, which means that the $name variable is controllable by the user and potentially includes relative paths (e.g. ../). Defining $target_file_to_save with the string concatenation $target_dir . $name makes this vulnerable to a Zip Slip directory traversal attack in the absence of additional file path validation or sanitization. The result of the string concatenation is opened as the output file for the archive entry contents on line 252.

Impact

The impact of this vulnerability is that arbitrary paths can be provided within the zip such as ../../../../payload.php and allow arbitrary files contained within the zip to be written to arbitrary directories on the server in the user context of the web server. While the default proof-of-concept writes a php file within the web root for code execution, an attacker can write arbitrary files outside of the web root in the user context of the web server as well. Additionally, the extracted filenames are not sanitized against the dangerous file extension list, enabling an extension filter bypass.

Exploitation

The following steps walk through the necessary sequence to exploit the zip slip directory traversal vulnerability in order to gain remote code execution (RCE). A proof-of-concept exploit script is available here.

Step 1 - Login

In order to invoke all necessary APIs, a valid administrator user session must be present. Thus, an administrator username and password must be provided.

Step 2 - Create a malicious zip file

The zip slip approach is derived from ptoomey3’s evilarc project.

The proof-of-concept default payload is phpinfo() and is created using the Python native zipfile module. The payload is saved to <webroot>/userfiles/cache/ by default:

<?php phpinfo(); ?>

The equivalent command to create the zip with evilarc is:

python evilarc.py -o unix -d 4 -f payload.zip payload.php -p userfiles/modules

Step 3 - Upload zip

Now that a malicious zip file has been created, it needs to be uploaded to the server. The file is uploaded as a generic file via the /plupload endpoint, and then moved into the backup directory in steps 4 & 5.

Step 4 - Determine webroot file path

Knowing the webroot is necessary in the subsequent step as an absolute filepath is required to move the file into the backup directory. The webroot of the site is determined the ?debug=true output on the landing page, matching against the DefaultController.php path. Everything preceding /src is the webroot on the server file system.

Step 5 - Move the uploaded to backup

A specific API endpoint /api/Microweber/Utils/Backup/move_uploaded_file_to_backup exists to move files into the backup directory, which is used to move the uploaded zip file into the backup directory.

Step 6 - Restore the backup

Now that the malicious zip file is uploaded and moved into place, it’s time to extract it and exploit the zip slip directory traversal vulnerability.

Utilizing the /api/Microweber/Utils/Backup/restore endpoing with id=payload.zip triggers an insecure extraction of the zip file.

The Microweber/Utils/Backup/restore function will attempt to extract the provided zip filename from the backup directory, but does not properly sanitize extracted filenames to prevent a zip slip.

Since the directory created to extract the zip files is within the webroot with a consistent depth of 4 from the root (/storage/cache/backup_restore/<md5 hash>/), a directory traversal of depth 4 will yield the webroot for a standard installation.

Step 7 - Profit! (i.e. Remote Code Execution)

As much as everyone loves a good phpinfo page, shell_exec is a much more interesting function to have access to via a remote client.

Upload a shell_exec payload:

./microweber_rce.py --hostname "http://microwebertest.com" --username "admin" --password "password123" --payload '<?php if (isset($_REQUEST["fexec"])) {echo "<pre>" . shell_exec($_REQUEST["fexec"]) . "</pre>";} ?>'

Execute whoami:

http://microwebertest.com/userfiles/cache/payload.php?fexec=whoami

With shell_exec, an attacker can now download an execute an additional exploit and execute it. Or instead of shell_exec, and attacker could upload a PHP reverse shell directly.

The Fix

Microweber responded very quickly and had a patch committed within a few of hours of verifying the vulnerability. The patch addresses the vulnerability by skipping filenames containing .. in the backup, and was applied to both the zip_open and gzinflate extraction execution trees.