237722935617694Ĭontent-Disposition: form-data name="upload_file" filename="test.zip"Ĭontent-Disposition: form-data name="appid"Ĭontent-Disposition: form-data name="filename" Access “/capture/custom_16/custom.py” to execute its contentĭo a POST request to “/capture/handler.py/custom_upload”, to upload the payload: POST /capture/handler.py/custom_upload HTTP/1.1.Upload ZIP file with a file called “custom.py” with the desired Python payload inside.So if a custom python is uploaded, accessing the file through the web will execute the content: The content of the ZIP file must be a “custom.py” or “custom.html” file.Īs result, there is a RCE vulnerability, because when the module is installed, the web server configuration is modified to execute CGI files (as python) from “/capture/” folder.
Anyway, it is always between 1-35, which is short enough to identify it in a few tries (in the worst case). The id is consistent, but in older versions may change. The uploaded files (if packed correctly) will be extracted and copied to: It results in an arbitrary file upload vulnerability, which allows remote unauthenticated users to write custom python/HTML files to a known folder.Īll Untangle plugins has its own application id, by default the captive portal id is “16”. The component does not check if the user is authenticated before processing the upload. There is an administrative functionality in this module to upload custom python scripts or HTML pages, packed as ZIP file. The component URI is not restricted to local users, so it can be accessed also from the administrative interface, which is enabled by default on WAN interfaces to remote users, through HTTPS (443). It forces all traffic to be authenticated before giving access to the network, and redirects all HTTP/HTTPS request to a login/disclaimer URL (“/capture/handler.py”). This module works as 2FA authentication system, which enables multi user login (in VPN or LAN environment for example) and custom firewall rules for each one. This module is installed by default with several other recommended modules. The Untangle NG Firewall appliance includes a free module called “Captive Portal”.
0 kommentar(er)
