Rconfig 3.9.4 File Upload RCE

Rconfig File Upload RCE Exploit

Remote Code Execution via File Upload (CVE-2020-12255)


The rConfig 3.9.4 is vulnerable to remote code execution due to improper checks/validation via the file upload functionality. 
The vendor.crud.php accepts the file upload by checking through content-type and it is not restricting upload by checking the file extension and header. 
Due to this flaw, An attacker can exploit this vulnerability by uploading a PHP file that contains arbitrary code (shell) and changing the content-type to `image/gif` in the vendor.crud.php. 
since the validation checks are happening through content-type the server would accept the PHP file uploaded ultimately resulting code execution upon the response when invoked. 


Steps To Reproduce-:

1. Login to the application.

2. Go to https://ip-rconfig/vendors.php and click on ‘Add Vendor’.

3. Click on the browse, upload PHP file that contains backdoor or shell and Intercept the request using burp suite.

4. Now Change the `Content-Type` to `image/gif`.

5. Go to https://ip-rconfig/images/vendor/shell.php?cmd=whoami 

Note:- shell.php is a uploaded file

Interesting!

Thank you farid007