Rapid7 Vulnerability & Exploit Database

php imap_open Remote Code Execution

Back to Search

php imap_open Remote Code Execution

Disclosed
10/23/2018
Created
03/19/2019

Description

The imap_open function within php, if called without the /norsh flag, will attempt to preauthenticate an IMAP session. On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary. Ssh's ProxyCommand option can be passed from imap_open to execute arbitrary commands. While many custom applications may use imap_open, this exploit works against the following applications: e107 v2, prestashop, SuiteCRM, as well as Custom, which simply prints the exploit strings for use. Prestashop exploitation requires the admin URI, and administrator credentials. suiteCRM/e107 require administrator credentials. Fixed in php 5.6.39.

Author(s)

  • Anton Lopanitsyn
  • Twoster
  • h00die
  • Paolo Serracino
  • Pietro Minniti
  • Damiano Proietti

Platform

Unix

Architectures

cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/php_imap_open_rce
msf exploit(php_imap_open_rce) > show targets
    ...targets...
msf exploit(php_imap_open_rce) > set TARGET < target-id >
msf exploit(php_imap_open_rce) > show options
    ...show and set options...
msf exploit(php_imap_open_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;