module

Softing Secure Integration Server v1.22 Remote Code Execution

Try Surface Command
Back to search
Disclosed
2022-07-27
Created
2024-07-19

Description

This module chains two vulnerabilities (CVE-2022-1373 and CVE-2022-2334) to achieve authenticated remote code execution against Softing Secure Integration Server v1.22.

In CVE-2022-1373, the restore configuration feature is vulnerable to a directory traversal vulnerablity when processing zip files. When using the "restore configuration" feature to upload a zip file containing a path traversal file which is a dll called ..\..\..\..\..\..\..\..\..\..\..\Windows\System32\wbem\wbemcomn.dll. This causes the file C:\Windows\System32\wbem\wbemcomn.dll to be created and executed upon touching the disk.

In CVE-2022-2334, the planted wbemcomn.dll is used in a DLL hijacking attack when Softing Secure Integration Server restarts upon restoring configuration, which allows us to execute arbitrary code on the target system.

The chain demonstrated in Pwn2Own used a signature instead of a password. The signature was acquired by running an ARP spoofing attack against the local network where the Softing SIS server was located. A username is also required for signature authentication.

A custom DLL can be provided to use in the exploit instead of using the default MSF-generated one. Refer to the module documentation for more details.

Authors

Chris Anastasio (muffin) of Incite Team
Steven Seeley (mr_me) of Incite Team
Imran E. Dawoodjee imrandawoodjee.infosec@gmail.com

Platform

Windows

Architectures

x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/http/softing_sis_rce
    msf exploit(softing_sis_rce) > show targets
        ...targets...
    msf exploit(softing_sis_rce) > set TARGET < target-id >
    msf exploit(softing_sis_rce) > show options
        ...show and set options...
    msf exploit(softing_sis_rce) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today