search

Manisso / fsociety

fsociety Hacking Tools Pack – A Penetration Testing Framework
MIT License
10.64k stars 1.99k forks source link

Security Notice & Bug Bounty - Remote Code Execution - huntr.dev #116

Open huntr-helper opened 4 years ago

huntr-helper commented 4 years ago

This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

Details

The FSociety tool is an amazing tool to automatize some pentesting tools like Nmap in order to provide a terminal GUI. However, the commands are executed through the python2 formatting system strings inserted inside the os.system() function, which doesn't prevent the injection of new options/arguments, but also of new commands which aren't supposed to be executed. Even if the tool isn't a module, so it's harder that it would be used inside a more complex system, it may comport some interesting issues like RCE inside a website which could give access via a web UI to the tool and return the result of the tool. It's not too difficult find website which do this and the unsanitized concatenation could lead to arbitrary command injection.

POC

Video here: https://vimeo.com/user106572974/review/434090026/10b53c5ee8 (pass: hacked)

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

We will submit a pull request directly to your repository with the fix as soon as possible. Want to learn more? Go to https://github.com/418sec/huntr 📚

Automatically generated by @huntr-helper...

huntr-helper commented 4 years ago

‎‍🛠️ A fix has been provided for this issue. Please reference: https://github.com/418sec/fsociety/pull/1

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.